Broker-based bus protocol and multi-client architecture

ABSTRACT

A system and method for an eSync bus protocol is provided. The eSync bus protocol uses a broker to route communications between electronic devices within an electronic environment, such as within a vehicle or the like. The electronic devices may first register with the broker, and thereafter send messages to the broker for routing to other registered electronic devices. In this way, the broker may as an intermediary to route communications using the eSync bus protocol. A multi-client architecture is also provided in which multiple domains may be defined by the functions performed by electronic devices within a respective domain.

REFERENCE TO RELATED APPLICATION

This application claims the benefit of U.S. Provisional PatentApplication Ser. No. 62/635,648, filed on Feb. 27, 2018, incorporated byreference herein in its entirety.

TECHNICAL FIELD

This application relates generally to bus protocols. More specifically,this application relates to a broker-based bus protocol in which abroker acts as an intermediary between communicating devices within asystem (such as within a vehicle, a building or the like) which maycomprise a multi-client architecture.

BACKGROUND

Vehicles today include electronics to control and manage the vehicle.The electronics may be in various forms, such as microprocessors,microcontrollers, or the like. The electronics in the vehicle maycommunicate using a variety of networks and protocols, such asin-vehicle Ethernet, a controller area network (CAN) bus, or the like.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a block diagram of functional devices within avehicle and a proprietary bus interconnecting the functional devices.

FIG. 2 illustrates a first block diagram of devices for updatingsoftware in a connected vehicle.

FIG. 3 illustrates a third block diagram of device interconnect in nextgeneration in-vehicle architecture for updating software in a vehicle.

FIG. 4 is a first block diagram of an in-vehicle Server, Client andAgent architecture.

FIG. 5 is a second block diagram of an in-vehicle network architectureusing multiple gateways.

FIG. 6 is a third block diagram of an in-vehicle gateway withinterconnected ECUs for next generation vehicle such an electricvehicle.

FIG. 7A is a block diagram illustrating disruption recovery proceduresfrom the server to the vehicle and within devices in the vehicle.

FIG. 7B is a block diagram illustrating Software Over-the-Air (SOTA) formanufacturing in bootstrap mode on assembly line.

FIG. 8 is a block diagram of security architecture from the server inthe cloud to in-vehicle client.

FIG. 9 illustrates a tree address structure may be used to identify oneor a group of devices.

FIG. 10A illustrates a flow diagram for initializing or registering adevice with the broker.

FIG. 10B illustrates a flow diagram for a sender to send a message viathe broker.

FIG. 10C illustrates a flow diagram for a recipient to receive a messagevia the broker.

FIG. 10D illustrates a flow diagram of a sender sending a message torecipient(s) via the broker.

FIG. 10E illustrates a flow diagram of a client device communicatingwith the broker.

FIG. 10F illustrates a flow diagram of a client device requestingdisconnection from the broker.

FIG. 11 illustrates a sequence diagram for broker authentication andtransmission of keys.

FIG. 12A is a block diagram of independent dual domains within avehicle.

FIG. 12B is a block diagram of dependent dual domains within a vehicle.

FIG. 13A is a block diagram of independent dual domains within a vehiclewhere each independent domain includes a broker through whichcommunications within the respective domain communicate.

FIG. 13B is a block diagram of dependent dual domains within a vehiclewhere each dependent domain includes a broker through whichcommunications within the respective domain communicate.

FIG. 14 is a general computer system, programmable to be a specificcomputer system, which may represent any of the computing devicesreferenced herein, such as the head unit or the smartphone.

DETAILED DESCRIPTION

Electronic devices may be present in a variety of contexts, such asvehicles, buildings, passenger ships, trains, automated mass transitsystems, or any other type of large constituent system. As one example,software may be present in one or more electronic devices resident in avehicle. As another example, software may be present in a plurality ofelectronic devices within a building or other type of dwelling orresidence. In particular, buildings may necessitate extensivemonitoring, with electronics described herein to manage variousoperations in the buildings, including their energy consumption,emergency evacuation, etc. The building may have multiple zones (such asmultiple floors) with each zone have one or more electronic devicesassigned or associated with the respective zone. In the multi-floorbuilding example, a building with 30 floors may have an electronicdevice (or a set of electronic devices) assigned or associated with eachrespective floor in order to control communication, heating/airconditioning, fire safety, and the like. As still another example,electronic devices may be used in passenger ships, trains, or automatedmass transit systems.

The electronic devices within an environment such as a vehicle may seekto communicate with each other. As one example, a first electronicdevice in the vehicle may seek to update software in a second electronicdevice in the vehicle. As another example, a first electronic device inthe vehicle may seek to transmit a message (such as a user interface(UI) message or an alert message) to a second electronic device in thevehicle. Thus, any discussion below regarding communications for avehicle may likewise be applied to communications in any other context,such as in the context of a building.

In one implementation, an eSync bus protocol may use a broker that mayact as an intermediary between electronic devices in the environment,such as the intermediary to route messages between the first and secondelectronic devices in the vehicle. The broker may comprise a standalonedevice or may comprise a device instantiated within another device. Inthis regard, broker, broker device, or broker module may be usedinterchangeably in any of these configurations. In one implementation,the electronic devices are unable to route messages to each other. Asone example, an electronic device, acting as the sender of the message,does not have the address (such as the network address or the nodewithin the network, e.g., at a particular node and/or on a specific buswithin the vehicle, such as sitting on the Ethernet bus or on the CANbus) of another electronic device, acting as the receiver of themessage. This may be particularly the case in vehicles, which maycommunicate via multiple networks, such as Ethernet, Controller AreaNetwork (CAN), or the like. Alternatively, or in addition, theelectronic devices may be configured only to accept/process messagesreceived via the broker device. As one example, upon registration of anelectronic device with the broker, the electronic device may be assigneda unique designation that may be used for addressing. In this example,the recipient electronic device may thus only process messages with theunique designation, which indicates that the messages were sent via thebroker. In another example, the recipient electronic device, uponregistering itself with a broker, establishes a duplex communicationchannel that is exclusive to the device and the broker. In this example,the recipient electronic device may thus be contacted through thischannel, which would indicate that the messages come from the broker. Inthis regard, messaging may be routed via the broker, which may reduce orprevent multicast or broadcast messaging (e.g., where a message istransmitted to a group of destination computers simultaneously).Instead, the broker may transmit messages via “limited-cast” in whichthe messaging is specifically addressed.

In this regard, the broker may act as the postal service within theenvironment routing mail from one location to another. For example, thesender of the message may have the name (e.g., “John Doe”) or otherdesignation of the recipient, but not the address of the recipient(e.g., “123 Main Street, New York City, N.Y. 10004”). As anotherexample, the sender may have the name and the address of the recipient,but not the ability (e.g., the means to navigate the streets) in orderto be the entity that routes the mail. As described further below,during registration, the broker may correlate the name (or othernon-address indication) to the address (e.g., correlating “John Doe” to“123 Main Street, New York City, N.Y. 10004”), and also has the abilityto route the mail to the ultimate address. Thus, when a sender wishes tosend a message to “John Doe”, the sender may send the message(indicating that the recipient is “John Doe” and/or the address) to thebroker, with the broker using the table correlating the names toidentify the address (“123 Main Street, New York City, N.Y. 10004”) anduses its knowledge gained during registration in which to route themessage. In another example, the sender may wish to send a type ofmessage (such as an alert). In the context of the “John Doe” example, if“John Doe” registered for “weather alerts” with the broker, the brokerhas correlated either one or both of “John Doe” or “123 Main Street, NewYork City, N.Y. 10004” with “weather alert”. Thus, in the instance wherethe sender sends a message with a type “weather alert” to the broker,the broker may either:

(1) compile all of the addresses that are correlated to “weather alert”and transmit the “weather alert” message to those compiled addresses(e.g., send the “weather alert” message to “123 Main Street, New YorkCity, N.Y. 10004” and to other addresses that have signed up for the“weather alert” messages)); or

(2) compile all of the non-addresses (e.g., “John Doe”) that arecorrelated to “weather alert” and send those compiled non-addresses backto the sender. The sender then crafts the “weather alert” message(s)with the non-addresses (e.g., “John Doe”), with the broker then routingthose “weather alert” message(s) with the non-addresses (e.g., “JohnDoe”) by correlating the non-addresses with the addresses (e.g.,correlating “John Doe” with “123 Main Street, New York City, N.Y.10004”).

Thus, in one implementation, the broker may register electronic devicesin the environment (e.g., registration of electronic devices in thevehicle). The registration may be initiated by the electronic devices(e.g., the broker sits at a predetermined address location with arespective electronic device sending a registration request with itscertificate to the broker to initiate the registration process). Theregistration may comprise the broker validating the electronic device(e.g., via a certificate associated with the electronic device, whichmay be sent from the electronic device to the broker or obtained by thebroker from a third party device, as discussed below) and/or theelectronic device validating the broker.

In one implementation, the broker may validate the electronic device inorder to determine whether the electronic device is entitled tocommunicate with or via the broker. Validation may be performed in oneof several ways. In one way, the broker may review the certificateassociated with the electronic device (e.g., the certificate that theelectronic device transmitted with the registration request) in order tomake the validation determination. In one implementation, thecertificate may be generated by (or caused to be generated by) thebroker. For example, the broker may include (or may communicate with) acertificate management authority in order to generate the respectivecertificate for the electronic device. As discussed further, thecertificate may provide any one, any combination, or all of: (1) anon-address indication of the designation of the electronic device(which may be subsequently used by an external server or an eSync ClientModule to include in a message to the broker so that the broker mayroute the message to the electronic device); (2) an indication of theprivileges assigned to the electronic device (e.g., the types ofmessages the electronic device is allowed to receive (e.g., allowed toreceive UI messages; disallowed to receive alert messages); the types ofelectronic devices that the electronic device is allowed to communicatewith (e.g., allowed to communicate with eSync Client Modules, but notwith other electronic control units (ECUs)); the specific devices thatthe electronic device is allowed to communicate with (e.g., allowed tocommunicate with eSync Client Module 1, but not eSync Client Module 2));or (3) an indication that the electronic device is entitled tocommunicate with the broker. In this way, the certificate may indicatethe one or more privileges that the respective electronic deviceassociated with the certificate has.

Alternatively, or in addition, the electronic device may validate thebroker in order to determine whether the broker is entitled to routecommunications to and/or from the electronic device. Validation maycomprise the electronic device reviewing a certificate associated with(and optionally provided by) the broker.

Responsive to validating the electronic device and/or the broker, thebroker may update one or more tables (e.g., data constructs) correlatinga non-address indication(s) and/or types of message(s) to addressindication(s) of the respective electronic device. As discussed above,the non-address indication associated with the respective electronicdevice may be correlated to the address indication and/or the types ofmessages the respective electronic device is allowed to receive and/orallowed to send. In this regard, the one or more tables may correlateaddress information (e.g., used to route information to a node withinthe environment such as a node within the electronic system of thevehicle) to non-address information (e.g., information which mayidentify the respective electronic device).

For example, via the request of the respective electronic device toregister with the broker, the broker may identify the address in thesystem. As one example, the respective electronic device may have anaddress akin to a media access control (MAC) address, which may comprisean Ethernet hardware address (EHA), hardware address or physicaladdress. The electronic device may reside at a network node (which maybe a communication endpoint) or may reside within a unique address ofthe network node (e.g., multiple electronic devices, such as an eSyncClient Module and the broker, may reside at the node of a gatewayserver, discussed below; in this regard, the different electronicdevices, such as the eSync Client Module or the broker, may have uniqueaddresses within the node of the gateway server). As discussed herein,the eSync Client Module may comprise a standalone device or may comprisea device instantiated within another device. In this regard, the eSyncClient Module and eSync Client device may be used interchangeably andmay be used in either configuration. Further, as discussed below, theeSync Client Module may perform various functions. In either instance,the broker may correlate in its one or more tables the non-addressdesignation with the address designation. The address designation maycomprise a physical address (such as may exist for ECUs or sensors) ormay comprise a non-physical address (such as may exist for micro serviceagents or the eSync Client Modules which do not carry physical addressbut are addressable through the exception or reserved address space). Inthis way, the eSync Client Module or external server may include thenon-address designation in the message to the broker. The broker, inresponse, may access the one or more tables (identifying the addressdesignation based on the non-address designation in the message) toroute the message. In another example, an exclusive duplex communicationchannel can be established by the eSync Client Module to the broker, sothe broker may communicate with the particular eSync Client Modulethrough such communication channel; a TCP channel is an example of sucha channel. In this example, the internal table of the broker will bepointing to such a channel through some sort of a descriptor orreference.

In this way, the broker may communicate with various electronic deviceswithin the environment. In particular, the configuration is akin to avirtual communication hub-and-spoke between each of the electronicdevices and the broker. Further, the electronic devices may resideacross different networks; nevertheless, the respective virtualcommunication hub-and-spoke between the respective electronic device andthe broker allows the senders to be unaware of the address within theenvironment (e.g., an eSync Client Module does not need to know theaddress of the recipient ECU, and vice-versa) or even know thearchitecture of the system. Rather, in one instance, the sender and/orthe recipient need only know the address of the broker (e.g., forregistration and for transmission and/or receipt of messages). Inanother instance, such as a sending a type of message (such as a UImessage or an alert message), the sender does not even need to know theaddress of the recipients. Rather, the sender need only tag the message,with the tag indicating the list of the message recipients, e.g., “UIdevice”. The broker, in response to receipt of the message, may identifythe addresses of the electronic devices that are entitled to receive thetype of message, and route accordingly.

After registration, the broker may receive one or more messages. As oneexample, the broker may receive a session key message from a firstelectronic device, with the session key message including an encryptedsession key (e.g., encrypted with the public key of the secondelectronic device) and indicative of a non-address indication of asecond electronic device. For example, an eSync Client Module may wishto communicate with a specific ECU (such as to transmit a softwareupdate that the eSync Client Module received from an external server).The eSync Client Module may obtain the public key of the specific ECU(e.g., by the eSync Client Module requesting the public key from thebroker, which responsive to the request, the broker sends the public keyto the eSync Client Module; and/or by the eSync Client Module requestingthe public key from a third party device either inside or external tothe vehicle). The eSync Client Module may include the non-addressindication (e.g., a serial number associated with the specific ECU or atextual string identifying the specific ECU (e.g., “ECU1” as identifiedin the certificate associated with the specific ECU)). The broker mayroute, using the non-address indication of the second electronic deviceand the one or more tables, the session key message to the secondelectronic device.

For example, the specific ECU was previously registered, so that thebroker updated the tables to correlate the non-address indication toaddress indication (e.g., “ECU1” to node X.Y.Z). In response to receiptof the session message, the specific ECU may decrypt, using its privatekey, the session key in the payload of the session message. Thereafter,the eSync Client Module may send a session message to the broker, withthe session message including at least a part of the message (such asthe payload) encrypted with the session key, and the non-addressindication of the specific ECU (e.g., “ECU1”). In response to receivingthe session message, the broker may route, using the non-addressindication in the session message (e.g., the “ECU1”) and the one or moretables, the session message to the specific ECU (e.g., use the tables toroute the session message to node X.Y.Z. In one implementation, thebroker does not decrypt the session key message (at least a part ofwhich may be encrypted with the public key of the specific ECU, as it ismade impossible for the broker to learn the session key used bycommunicating parties) and/or the session message (at least a part ofwhich (such as only the payload) is encrypted with the session key),instead merely routing the session key message and/or the sessionmessage to the specific ECU. For example, the broker does not decrypt(e.g., the broker is programmed not to use its decryption capabilitieswhen routing the session message) and/or is unable to decrypt (e.g., thebroker does not have decryption functionality in order to performdecryption) the session message when routing. Thus, the eSync ClientModule may send a software update to the specific ECU encrypted usingthe session key. Thus, the broker, as part of the registration,establish the validity of the different devices, including the eSyncClient Module and the ECU. Further, the broker facilitates thetransmission of the session key by routing the message with the sessionkey from the eSync Client Module to the ECU. However, after that, thebroker does not secure the channel (does not encrypt or decryptcommunications with its own session key), instead merely previouslyverifying the certificates and the addresses of the eSync Client Moduleand the ECU, since the communication is secured between the terminalparties. Alternatively, or in addition, in response to receiving amessage from a sender and delivering it to the receiver, the broker maysend a confirmation message back to the sender indicating success inreceiving the message and/or success in routing the message. Further,separate from the eSync Client Module sending a message to an ECU, anECU may send a message via the broker to another ECU (such as from ECU1to ECU2). The broker does not necessarily distinguish or deviate fromthe routing dependent on which electronic device is the sender or thereceiver. In this regard, in one implementation, the routing of amessage sent from the eSync Client Module is the same as the routing ofa message sent from the ECU.

As discussed further below regarding the presence message, the brokermay send a presence message to one, some, or all devices in theelectronic environment. The presence message may comprise: (1) a listingof the electronic devices that have registered with the broker (e.g.,the non-address designation of the electronic device as indicated by thecertificate associated with the electronic device); and/or (2) ahierarchical structure (such as flat address (e.g., /gw/ECU2) asillustrated in FIG. 9, discussed below). For example, an eSync ClientModule may receive the presence message, and may forward the presencemessage to an external server, such as a software update server or amessage server. In this way, the server may be apprised of thecomponents available in that particular environment. The primary goal ofpresence message is to have ECUs or eSync Client Modules to be aware ofother participants of the bus, which may in some cases alter theirbehavior. For example, an entertainment system may alter its display oroutput if different sets of speakers are present. In another example, aneSync Client Module may decide to not communicate to the ECU, or expectan answer from an ECU, if no presence information from that ECU has beenreceived. Again, this presence information may manifest in differentforms, such as a list of devices registered with the broker and/or flataddresses (e.g., /gw/ECU2/TCM) that give information regarding hierarchybut insufficient information to route messages directly to the endpoint.As discussed in co-pending in co-pending U.S. patent application Ser.No. ______ entitled “System and Method for Updating Software in anElectronic Device” filed on the same day as the present application,attorney docket no. 014442-18017B-US, incorporated by reference hereinin its entirety, a target device may not have the capability to decryptand/or decompress the software update. In this regard, a node proximateto the target device may perform the decryption and/or decompression,and then transmit the decrypted/decompressed software update to thetarget device for installation. Because the flat addresses (whichinclude the hierarchy) are sent to the eSync Client Module (and in turnto the external server), one or both of the Client Module or theexternal server may designate the node proximate to the target devicethat may perform the decryption and/or decompression. As one example, inthe event that the transmission control module (TCM) is unable toperform the decryption and decompression, the node closest to the TCM(indicated by the flat address of /gw/ECU2/TCM as being ECU2) mayperform the decryption and decompression. In this regard, one or both ofthe eSync Client Module or the external server may instruct (such as viathe manifest) ECU2 to perform the decryption and decompression prior totransmission (either directly or via the broker) to TCM of thedecrypted/decompressed software update for installation at the TCM.

In practice, the software update server may send to the eSync ClientModule a manifest that is included in the software update and containsthe non-address designation of the electronic device subject to thesoftware update. Alternatively, the software update is sent inconjunction with the manifest (which may include the non-addressdesignation and/or the address designation of the electronic device(s)subject to the software update). In response, the eSync Client Modulemay send message(s) to the broker with the non-address designation (forthe broker to route the message) and with the software update as thepayload (optionally encrypted using the session key).

Further, the broker may, prior to routing a message and using the one ormore tables, determine whether one or both of the sender or recipient isentitled to send and/or receive the message. For example, as part of theregistration process, the broker may analyze the certificate of therespective electronic device in order to determine types of messages therespective electronic device is entitled to send and/or receive.Responsive to the broker determining that the sender is not entitled tosend the specific type of message and/or the recipient is not entitledto receive the specific type of message, the broker may deny routing ofthe message (such as the session message) to the recipient.

As another example, the broker may receive, from a sender, a messagethat includes a specific message type (e.g., a group message, an alertmessage, a UI message, etc.) and a payload, with the message notincluding any address indications for use by the broker device to routethe message. In a first implementation, responsive to receiving such amessage, the broker may route the message without further input from thesender. For example, the broker may use the one or more tables to obtainthe address information of the recipients who are to receive themessage, and then route the message to those recipients using theaddress information. In a second implementation, the broker may send thenon-address indications of the recipients (e.g., “ECU1”, “ECU2”, etc.)back to the sender, with the sender then sending subsequent messageswith the non-address indications for later routing.

In the first implementation, the broker may access the one or moretables correlating the message types to respective address indicationsof the electronic devices registered with the broker in order todetermine a subset of the electronic devices correlated to the specificmessage type. For example, responsive to receiving a message that is an“alert message”, the broker may determine, based on the one or moretables, the address indications (e.g., node X.Y.Z) for all of theelectronic devices that are registered to receive an “alert message”. Asanother example, responsive to receiving a message that is a specifictype of “group message” (such as a “group message” comprising “ECUgroup” indicative of all ECUs that have registered with the broker), thebroker may determine, based on the one or more tables, the addressindications (e.g., node X.Y.Z) for all of the electronic devices thatare registered to receive the specific type of “group message” (e.g.,all devices that are registered as ECUs with the broker). The broker maythen generate one or more messages with the payload and the addressindications of each of the electronic devices in the subset ofelectronic devices, and may then transmit the generated one or moremessages to each of the electronic devices in the subset of electronicdevices.

In the second implementation, the broker may access the one or moretables correlating the message types to respective address indicationsof the electronic devices registered with the broker in order todetermine a subset of the electronic devices correlated to the specificmessage type. For example, responsive to receiving a message that is an“alert message”, the broker may determine, based on the one or moretables, the non-address indications (e.g., “ECU1”, “ECU2”, etc.) for allof the electronic devices that are registered to receive an “alertmessage”. The broker may then send the list of non-address indications(e.g., “ECU1”, “ECU2”, etc.) to the sender device. Alternatively, thesender may send a polling message (e.g. send me a list of all devicesthat are registered to receive an “alert message); responsive thereto,the broker may then send the list of non-address indications (e.g.,“ECU1”, “ECU2”, etc.) to the sender device. In response to receiving thelist of non-address indications, the sender may send one or moresubsequent messages, the one or more subsequent messages including thenon-address indications for each of the electronic devices in the subset(e.g., in a single message including the entire list of non-addressindications or multiple messages with different non-addressindications). In response to receiving the one or more subsequentmessages, the broker may perform the typical routing (correlating anon-address indication in a message sent from the sender into an addressindication for transmission to the recipient) by accessing the one ormore tables that correlates non-address indications with addressindications in order to access the address indications correlated toeach of the electronic devices in the subset. The broker may then routeone or more subsequent messages to the address indications correlated toeach of the electronic devices in the subset.

Electronic devices may comprise separate standalone devices (with aseparate memory and processor) or may comprise sub-devices within anelectronic device. As merely one example, the broker (or broker device)may be resident within a same electronic device (e.g., a gateway server)as an eSync Client Module. In particular, the broker may comprise afirst software thread in a gateway server in the vehicle and the eSyncClient Module may comprise a second software thread in the gatewayserver.

The eSync bus protocol may comprise uniform and secure communicationfunctionality between various devices, such as different ECUs, acrossone, some, or all in-vehicle networks. In this regard, the eSync busprotocol enables inter-device (such as inter-ECU or ECU to eSync ClientModule) communication across buses of different types (e.g., one or moredevices sitting on the CAN bus communicating with one or more devicessitting on the Ethernet bus).

Typically, vehicles may have a plurality of different types of networks,such as Ethernet, CAN, etc. Each of the networks has strengths anddrawbacks vis-à-vis the vehicle environment. For example, in-vehicleEthernet does not have a proper protocol defined for inter-ECUcommunication. As another example, CAN has Unified Diagnostic Services(UDS), but it does not have security. As still another example, CAN is abroadcast methodology, which may be bandwidth inefficient.

In one implementation, the eSync bus protocol may include any one, anycombination, or all of:

a defined remote procedure call (RPC) mechanism based on the messagestructure, such as used in peer-to-peer (P2P) communications only;enable delivery of arbitrary messages between two systems; enabledelivery of arbitrary messages to multiple systems simultaneously, basedon subscription; authorization parameters include any one, anycombination or all of: a flag indicating bus access is allowed; zero ormore group names the peer belongs to; or one or more peer names (ECU,etc.) that the peer represents; support security, includingauthentication and/or authorization mechanism (e.g., X.509); supportencryption mechanism (e.g., AES); System Network Architecture (SNA) logand trace features; SNA tailored to internet of things (IoT) orcar-to-car communications (e.g., Car2X_ solutions); or SNA for cloud appsupport.

The eSync bus protocol may support one or more address types, such asany one, any combination, or all of: special addresses; update agent; orgroups. Example special addresses include, without limitation: eSyncClient Module (whereby the entity is an eSync Client Module or othertype of inter-process communication management software device); orBroker (discussed in further detail below). In this regard, certainaddresses may be reserved by the eSync bus protocol and may have specialmeaning. Further, an update agent address may comprise a hierarchicaladdress structure (discussed further below) in which a message is set toan address in the form of Xi/ . . . /Xn is delivered to all of Xi/ . . ./Xj where j≤n. Various types of groups are contemplated. For example, inone implementation, general purpose text destination strings may beused, with the group name determined by the specific implementation.Example implementations include, without limitation:

connection-info (a connection information query is posted to this group,and peers from this group may post connection information to CommMgr;CommMgr-report (all reporting information about ongoing updates may beposted to this group); update-listener (all communications ever sent toany update agent by the CommMgr may also copied to this group);CommMgr-UI (this group may receive select messages from CommMgr;authentication PIN request messages may be sent to this group; othertypes of messages, with a user interface (UI) outcome are likewisecontemplated); or CommMgr-config (this group may receive requests forCommMgr configuration, and members of this group may influence CommMgrconfiguration).

Thus, the groupings may be based on any one, any combination or all of:a particular function; a type of device; or the like.

The eSync bus protocol is configured for various uses of addresses. Forexample, each participant may declare its address(es). In particular,each participant may declare as many addresses as needed, with at leastone address being designated. As discussed in more detail below, thedeclared address(es) becomes the address list of a respectiveparticipant. Further, various security protocols, such as X.509, arecontemplated. When using the X.509 identity mechanism, all addresses ofthe participant are declared in their respective X.509 certificate. Asdiscussed in further detail below, various types of communications thatinvolve the broker are contemplated. One type of message sent via thebroker (e.g., from a sender to a recipient) may be termed high-levelmessages. Another type of message whereby the broker is the originatoror the ultimate recipient (e.g., a device establishes a connection withthe broker) may be termed low-level messages.

Further, one, some or all of messages may include at least onedestination address, and may include as many as addresses needed. Theaddress(es) in the message may comprise the address list of the message.As discussed in further detail below, the broker is configured toperform various functionality, including determining the recipients ofthe message. For example, when the broker receives a message sent from asender, the broker determines the participants that will receive themessage. In one implementation, the broker may make this determinationby matching all addresses from the address list in the message againstaddress lists of all connected participants (excluding the participantthat is sending the message, so there is no possible echo). If aparticipant has an address in the address list in the message thatmatches at least one address in the list of addresses of the message,the message will be delivered to this participant. This is discussedfurther below with regard to address matching.

When the message is delivered to a participant (e.g., a recipient), therecipient of the message may also receive the address(es) list of thesender. In one implementation, the recipient may examine the list ofaddress(es) of the sender, and use them as an authorizationconfirmation. In particular, the recipient may determine whether one,some or all of the addresses in the list of addresses of the sender isauthorized (e.g., authorized to send a message of a certain type, suchas an alert, an update, etc.). Responsive to making this determinationthat the sender is authorized, the recipient may determine that thepayload in the message is acceptable for processing (e.g., acceptablefor implementing as a software update, for processing of an alert,etc.). For example, if an eSync Client Module receives a connectionchange, the sender may be required to be in the “connection-info” group;otherwise, the recipient may reject the message since the connectioninformation in the message cannot be trusted (e.g., if the sender'scertificate does not indicate that the sender is included in the“connection-info” group, the sender is not authorized to send a messagecommanding a connection change). Alternatively, or in addition, thebroker may make the determination whether the sender is allowed to sendthe message (e.g., the broker may determine a type of message sent fromthe sender, and determine, based on the certificate of the sender,whether the sender is allowed to send the type of message; if the brokerdetermines that the sender is not authorized to send the type ofmessage, the broker refuses to route the message; if the determines thatthe sender is authorized to send the type of message, the broker routesthe message). If a message contains a report of an update agent havingversion information for a device node (e.g., for performing a softwareupdate as further described herein), the sender may be required to havean update agent address that matches the reported device node (e.g., therecipient may check the sender's certificate to determine whether theupdate agent address that matches the reported device node). Whendetermining such an authorization address, all addresses from theaddress list of the sender are considered, and matching a single addressmay be sufficient to grant the needed authorization. Alternatively,matching of all addresses may be required to grant the neededauthorization.

As discussed above, various devices, such as the broker, may performaddress matching. In one implementation, address matching may bedependent on the address type. For example, special addresses (such asthe eSync Client Module or the broker) may require an exact match of thespecial type. As another example, group addresses may require an exactmatch of the name of the group. As still another example, update agentaddresses may use a different matching algorithm. One example matchingalgorithm is as follows: considering that one is matching user agentaddress values L against user agent address value R: break down L intosequence of {Ln}, separated by forward slashes (n may be 0, in whichcase the sequence is empty), and {Rm}, accordingly.

If n<m, then the address doesn't match.

If all Li==Ri, for all i∈[0, n], then the address matches

Otherwise, the address does not match.

By way of example, update agent (UA) addresses may match against thesame or lesser path. If the participant declared its UA address as“/a/b”, the participant will receive messages for any update agentaddresses sent to “/a/b”, “/a/b/xxx”, etc., but not for “/a”.

In one implementation, address matching is not commutative for alladdresses. Thus, for certain addresses, address A may match B, butaddress B may not match A.

Fail-over Requirements may comprise: fail-over may be used forredundancy for high-availability; and have 2 (or more) brokers anddiscard duplicate messages upon receipt.

In one implementation, the eSync bus protocol includes authentication inone or more contexts including any one, any combination or all of:authentication (such as dual authentication) when registering with thebroker; authentication whether to allow a sender to send a message; orauthentication whether to allow a recipient to receive a message.Various authentication methodologies are contemplated. As one example,X.509 authentication credentials are contemplated. The certification mayinclude any one, any combination or all of: certification of theidentity of the device; certification whether the device is allowed toreceive certain messages (e.g., certain alerts); or certificationwhether the device is allowed to send certain messages (e.g., whetherthe device is allowed or disallowed from sending/acknowledging certaintypes of messages). Thus, in one instance, the certification may be usedto constrain a device from eavesdropping on communications when notentitled.

Further, the certification may be indicative of allowing certaindownloads and/or allowing updates to be according to a schedule.

Specific cryptographic algorithms contemplated include, but are notlimited to, RSA algorithms (such as RSA-OWEP, RS256, RS384) or non-RSAalgorithms. In particular, the following links include differentmethodologies (including symmetric or asymmetric algorithms, includingasymmetric key wraps and symmetric key wraps):{+}https://tools.ietf.org/html/rfc7518#section-4;{+}https://tools.ietf.org/html/rfc7518#section-5+;{+}https://tools.ietf.org/html/rfc7518#section-3+.

As discussed above, a broker may be used as a device for implementingthe eSync bus protocol. In one implementation, the broker may be acentralized actor in that messages are routed via the broker. Forexample, a client may connect to or register with the broker for thepurpose of sending and/or receiving messages. The broker may identifythe client by the network address(es) provided by the client. In oneimplementation, the broker may learn of the network address(es) of theclient implicitly, such as via a return address of the incomingconnection and/or the X.509 certificate(s) containing clientcredentials. Alternatively, or in addition, the broker may learn of thenetwork address(es) of the client explicitly, such as via polling theclient for its address(es).

In one implementation, the broker does not accept any messages from theclient until the client successfully identifies itself to (e.g.,registers with) the broker. As discussed in more detail below,successful identification may include any one, any combination, or allof: the broker authenticating at least one aspect of the client, such asthe identity of the client (e.g., based on a client certificate), theability of the client to receive and/or send a message (e.g., to receiveor send messages to group(s), etc.). Because of the use of the brokerand thus the separation of roles in communication, the following termsare used herein: sender, broker and recipient. The sender comprises asender of a message. The recipient comprises the receiver of themessage. The sender and the recipient may be the same entity fordifferent messages. When the message delivery direction does not matter,the sender/recipient is referred to as client. Further, in oneimplementation, to withdraw itself from the broker, the client mayexplicitly disconnect from the broker.

Various message formats for messages are contemplated. In oneimplementation, JSON Web Signature (JWS)/JSON Web Encryption (JWE) maybe used. For example, messages may be exchanged through JavaScriptObject Notation (JSON) messages. When exchanged on the wire, messagesmay be wrapped, such as multiple times, into JWE and JWS standards. Byway of example, the standards are discussed athttps://tools.ietf.org/html/rfc7515 andhttps://tools.ietf.org/html/rfc7516, respectively. The details on whenJWS or JWE is used are detailed in message flow discussion below. Thus,as discussed herein, any JSON Web message may be applied to a messageunder JWS or JWE.

Alternatively, message payloads may optionally not be in JSON, which isthe serialization used for messages so far. Optionally, ASN.1 may beused as well. It is contemplated to create a tool that converts JSONschemas to ASN.1 schemas, and have a converter that will convert one toanother and back. The same reasoning about UDS client capabilitiesapplies. The cryptography packaging format can therefore be CMS/PKCS#7.

When a JSON Web message is transmitted, the following guidelines mayapply to the contents of the JOSE (JavaScript Object Signing andEncryption) header fields: “alg” is not set to “none” (the list ofsupported algorithms is discussed below with regard to acceptedalgorithms and key sources); “cty” property has the value of“application/vnd.x14.bus message+json” for internal eSync bus protocolmessages, the corresponding JSON Web mime type for wrapped messages, orhigh level mime type as was specified by the application; “typ” propertyis not used; “crit” is not used; “enc” is as specified by acceptedalgorithms and key sources, discussed below; the names and values of theproperties that identify the key material are discussed below inaccepted algorithms and key sources; “x-x14bus” header property maycontain JSON serialized “Bus Object”, for applicable messages.

The bus object may be part of the JOSE message header for eSync busprotocol message, and may contain meta-information related to routing,or message integrity. The bus object may be defined by the following:

{  “$schema”: “http://json-schema.org/draft-06/schema#”,  “$id”:“https://dev-esync.excelfore.com/schema/json/xl4bus/xl4bus.json”, “type”: “object”,  “properties” : {   “destinations” : {    “type” :“array”,    “items” : { “$ref” : “xl4bus-address.json” }   },   “nonce”: { “type” : “string” },   “timestamp” : { “type” : “string”, “format” :“date-time” },   “stream-id” : { “type” : “number”, “minimum”: 0,“multipleOf”: 1, “maximum”: 65535 }  },  “additionalProperties” : true }

The timestamp value in the eSync bus protocol message header may bewithin a predetermined amount of time (e.g., 5 minutes) of the currenttime for message to be recognized; otherwise, the message may berejected. The NONCE value may not repeat within a predetermined amountof time (e.g., the last 10 minutes) (double the clock variationallowance in the example above). Further, in one implementation, theNONCE value may be no less than 64 characters long.

Various accepted algorithms and key sources are contemplated. Withregard to the signature, in one implementation, the RS256 signaturealgorithm is supported. Alternatively, or in addition, RS384 and RS512algorithms are supported. With regard to encryption, the key managementalgorithm may comprise RSA1_5, RSA-OAEP, or A256KW. Other algorithms arecontemplated. Further, the encryption algorithms may comprise eitherA128CBC-HS256, A256CBC-HS512 or A192CBC-HS384. Again, other algorithmsare contemplated. With regard to the public key reference, the publickey may be supplied with the “x5c” protected header parameter for thefirst message that is sent to the other side, and may either use “x5c”or “x5t#S256” property to identify the certificate for consecutivemessages. For encrypted messages, “x5t#S256” may be sufficient due to ithaving a smaller size.

As discussed in more detail below, there are various interactions withthe broker, including any one, any combination, or all of:initialization (or registration); normal operations; disconnecting;connectivity testing; or presence. With regard to initialization, theclient and/or the broker may initiate the connection and establishserialization (with the process of establishing the serializationmechanism depending on the transport). The broker may only send othermessages (such as non-registration messages) to the client after theregistration confirmation is fully sent. Further, in one implementation,the client cannot send any normal messages before the registration isfinished. In an implementation using connectionless transports, anexternal mechanism for guaranteed delivery is employed during theinitialization phase (though this may not be necessary for normaloperations). Finally, the presence message may contain “connected”information on all currently connected clients (e.g., clients that havepreviously connected with the broker).

With regard to normal operation, one, some, or all messages areencrypted for their final destinations. The messages may be encryptedusing the public keys of the intended recipients. In one implementation,the public key may simply be used to encrypt a symmetric encryption keythat encrypts the rest of the payload. Further, in one implementation,all recipients use X.509 authentication. In such an implementation, thepublic key of the corresponding X.509 certificate is to be used for suchencryption. To be able to encrypt messages with the keys of all therecipients, the sender may discover the connected recipients beforesending each message. As discussed further below, the sender may ask forthe certificate bodies for those certificates that the sender has notseen previously (or has disposed of).

The following is one example of a sequence for communications betweenthe sender and the broker when sending a message: sender requestsdestinations from the broker; broker sends destination information (inthe event that there are no destinations found, this may end thesequence); sender requests certificate details from the broker (e.g., tothe extent the sender does not have the certification information);broker sends the certificate details to the sender; sender sends themessage to the broker; broker sends confirmation of receipt of themessage and/or confirmation of transmission of the message to therecipient(s).

The following is one example of a sequence for communications betweenthe broker and the recipient when the broker delivers the message:broker sends the message to the recipient; recipient may requestcertificate details (e.g., recipient may request the certificate detailsof the sender for authentication by the recipient); broker may sendcertificate details responsive to request from recipient; and recipientmay confirm receipt of the message.

In this regard, a peer may request keys from other peers. For example,the peer decryption described here may include key requests andresponses. Responsive to key request(s) from other peers, a peer mayreply with a key response; however, in one implementation, in order forthe peer to respond, each key request is signed by the public key of thereceiver of the request (e.g., the peer subject to the request).Further, in one implementation, key requests need be encrypted. The peersubject to the request may have previously produced the key that iscurrently being requested. If no such key has been produced (e.g., thepeer did not previously produce the key), the peer need not respond tothe key request, and the stream may be aborted.

With regard to an electronic device (such as an eSync Client Module oran ECU) disconnecting from the broker, the following is an examplesequence: the electronic device sends a disconnect request to thebroker; the broker sends a disconnect acknowledgement to the electronicdevice; and one or both of the electronic device and broker terminatesthe connection.

If the protocol is stateful (e.g., TCP), the broker may invoke somefunction of the protocol to shut it down. For stateless protocols, noexplicit termination is needed.

With regard to groups/tree-like addresses (such as illustrated in FIG.9), there may be 3 types of addresses allowed:

(1) predefined address (e.g., eSync Client Module or broker, which maybe specified at the outset at a predetermined address, and may meancertain things. Sending a message to one of then reach the pre-defineddevice.)

(2) group addresses—single string address, destination identified by afull string match. One implementation of the eSync bus protocol includesdefining the names. There are also certain pre-defined names in adefault solution. Thus, if an electronic device assigns itself withaddress group designated as “bunny-rabbit”, any other electronic devicemay contact that electronic device by sending the message to the group“bunny-rabbit”. Multiple electronic devices may specify that they are amember of the group, in which case all electronic devices that indicatethat they are in the group “bunny-rabbit” will receive a messagetargeted to the group “bunny-rabbit”. However, such duplication (e.g.,multiple electronic devices connecting with the same address, receivingall of the correspondence to that address) is valid for all addresstypes.

(3) hierarchical addresses. The address comprises or consists ofvariable length path, separated by fixed address “words”. The chain maybe of any length (including zero). Example of chains include: “/a”;“/a/b”; “/a/b/c”. If an electronic device declares that it is at theaddress “/a/b”, the electronic device will receive every message thatstarts with “/a/b”, including “/a/b” itself. In on implementation, anelectronic device may declare to be at address of “/”, in which case theelectronic device will receive all messages directed to any hierarchicaladdress.

With regard to connectivity testing, the client, within certainintervals, may conduct a connection test (e.g., when underlyingconnection requires so). The connectivity testing is not required;however, the client may incur a higher risk of encountering a deadconnection when a message needs to be sent. In this regard, theconnectivity testing may be performed in advance of sending a message inorder to determine whether the connection is active. The connectivitytest may contain the following sequence: participant 1 sends a ping toparticipant2; participant2 sends a pong to participant1. In oneimplementation, the client may perform the connectivity test responsiveto identifying a predetermined event, such as determining that there isno data received from the connection within a certain amount of time.

With regard to presence, when there is a change in the recognition ofclients in the system (e.g., when a new client connects to ordisconnects from the broker), the presence information may bedistributed to all other connected clients. In one example, the sequencefor distributing presence information is as follows: the broker sends apresence message to all connected clients. In one implementation, thebroker may include functionality to combine multiple presence events, oreven have presence events cancel each other out, within a singlemessage. For example, the broker may compile multiple communicationsindicative of presence events, such as multiple communicationsindicative of new client connections, multiple communications of newclient disconnections, and/or multiple communications of new clientconnection(s) and disconnection(s), and responsive to a certaindetermination by the broker (such as based on a time elapse or based ona predetermined number of presence event communications received), thebroker may broadcast a communication indicative of multiple presenceevents. In one implementation, the combined information is not gatheredfor longer than a predetermined amount (e.g., one second). The brokermay buffer multiple connections with the same address, and not issuedisconnect events; however, the broker may always issue connect events.Thus, when a new client is connected, a presence message on that clientmay be issued regardless. However, there may be multiple clients withthe same group, special address, or update agent address. If one, thenanother update agent with the same address connects, between presencemessages, both may generate a connection event. If one only disconnects,a disconnect event may not be issued; a disconnected event may only beissued for an address when there is no more clients for that address.This results in an imbalance in the amount of connect and disconnectevents, which is intentional and by design.

With regard to the low level protocol, the communication may be brokendown by frames. For example, once a TCP connection is establishedbetween two peers, the only data that needs to be exchanged between thepeers is frame data as described below. The low level code of thelibrary may assemble incoming frames into: system frames (which may beprocessed by the low level itself); and normal frames (which may beassembled into messages).

Each frame may start with the 4 frame header bytes as defined below. Anyvalues used in the frame format may be big endian (network order) inwhich the most significant value in the sequence is stored first. Bytesand bits may be numerated as 0 based. The frame information may beencoded in the first byte (byte #0) of the frame. The following is anexample of a byte:

bits 7-6 (reserved, set to 0);

bit 5 (1—last frame in a message; 0—not last frame in a message);

Bit 4 (for normal frames: 0—not a final message (in sequence); 1—finalmessage);

Bit 3 (0—first message (request for connectivity test); 1—responsemessage (response for connectivity test);

Bits 2-0 (000—normal frame; 001—connectivity test; 010—stream abort;011—acknowledgement: both the acknowledgement and retransmit request areonly needed for protocols that do not guarantee delivery and sequence;100—retransmit request).

After the first byte (as formatted above), there may be additional bytes(such as 3 more bytes) containing the length of the remainder of thebytes. The information may be provided in network order. In oneimplementation, the length is not to contain the first 4 bytes that areconsidered the minimal header for each frame. The last 4 bytes of theframe may include a cyclic redundancy check, such as CRC-32 of all thedata of the frame, starting with the first byte. The CRC bytes mayalways be included into the length of the frame. CRC-32 value istransmitted in network order.

The connectivity test frames may include a cryptographic hash algorithm,such as contain a secure hash algorithm (SHA)-256 value of some randomstring that was generated for the test. Other cryptographic hashalgorithms are contemplated. The response may contain the same value asthe request; otherwise, the response may be ignored. Further, the formatmay be as follows: bytes 4-35: unique test value; bytes 36-39: CRC-32.

With regard to normal frames, streams may be used to separate databetween different messages. In particular, the low level protocol mayuse streams to separate the data. Each message exchange may run on aunique stream. When the protocol is connected, one side may always makean initial connection. The one side that makes that initial connection(typically the client) may use even numbered streams. The other side(typically the broker) may use the odd numbered streams. Once a streamhas started, all messages for the same stream may re-use the same streamID (or other identifier of the stream), until the final message isreceived. The stream number may be allocated when the first message issent. The client may use an atomic counter to keep track of streamvalues. Further, the client may re-use stream IDs after the finalmessage have been sent/received, and twice the message timeout time haspassed.

All frames within a stream may be numbered consecutively. The numerationcontinues throughout all the messages. The sequence numbers for theincoming and outgoing messages may be independent from each other. Theunderlying protocol handler may deal with re-sequencing the framesbefore handling them to the upper layer. If the message exchange runsout of sequence numbers (e.g., numeric overflow), the numeration mayrestart from 0. The sequence number may be an unsigned value.

With regard to the frame identifier, it may include the streamidentifier and sequence number. The frame identifier may be allocated 2bytes for each, such as: 2 bytes containing the stream ID; and 2 bytescontaining the sequence number.

For the normal frames, the minimal header is followed by: 2 bytescontaining the stream ID; and 2 bytes containing the sequence number.

The frame with the number 0 may be considered a special frame, and maycontain an additional first byte that contains the mime type informationfor the message: 00—application/jose; 01—application/jose+json;02—application/json; 03—application/vnd.x14.busmessage-trust+json.

In one implementation, a TCP-UDS proxy may be used and may be built-inat the broker as well, but may be separate if the electronic deviceconnected to UDS is not the same as the one running the broker, or ifthere are multiple UDS hosts. The proxy may convert low-level eSync busprotocol frames into UDS frames, rather than TCP packets.

With regard to stream cancellation, the stream cancellation frameincludes a payload, similar to a normal message. The stream cancellationframe may include no sequence number, with the entire message fittinginto a single frame. The payload may comprise a JWS message, and containa nonce, a timestamp and a stream ID. The stream may be canceled if thepayload can be verified. The minimal frame header may be followed by:content type (see frame format, discussed above); payload; and CRC-32.

As discussed above, encryption may be used in transmitting messages.Specifically, a message may be encrypted with a public key, which mayinclude creating a symmetric key (e.g., a session key), using thesymmetric key to encrypt content, and then encrypting the key itselfwith the public key.

As discussed above, one device (e.g., a sender) may send a communicationto another device (e.g., a receiver). In one implementation, the senderhas the public key(s) of the receiver (e.g., the sender requested thepublic key of the receiver, which may be obtained by the sender directlyfrom the certificate authority or from an intermediary, such as thebroker). In a specific implementation, the sender sends a privatemessage (S0) to the receiver. The sender may encrypt the message withthe public key(s) of the receiver, creating JWE message (51). In oneimplementation, the sender first compresses message (S0), with the JWEstandard supporting compressing the original body as part of encryption.Thereafter, the sender may sign the encrypted message (51) with one ofits keys (such as the private key of the sender), thereby creating JWSmessage (S2). The sender may further add routing information to JWSmessage (S2). The sender may then encrypt JWS message (S2) with thepublic key of the broker, thereby creating JWE message (S3). Afterwhich, the sender may transmit the JWE message (S3) to the broker.

Responsive to the broker receiving the JWE message (S3), the broker maydecrypt the JWE message (S3) with the broker's private key, whichproduces JWS message (S2) (or which results in failure). The broker maythen examine JWS message (S2) for the destination(s) of the message(which may be contained in the routing information added by the sender).The broker may perform each of the following for each receiveridentified by the routing information:

The broker may encrypt JWS message (S2) with the public key of therespective receiver, thereby creating message S4;

The broker delivers message S4 to the destination of the respectivereceiver;

The respective receiver decrypts message S4 with its private key, whichmust thereby produce S2;

The respective receiver may verify the signature of S2, and extract S1if validation succeeds

The respective receiver may decrypt S1 with its private key, therebyobtaining S0.

In one implementation, there is a confirmation by the receiver to thebroker of success in receiving the message.

Thus, as discussed above, a device may initiate the sending of a messagevia the broker to another device. Conversely, the broker may be theultimate destination of the communication. In this regard, messages maybe sent from the broker to the client, or the client may send a messageto the broker itself (e.g., not using the broker as an intermediary forsending a message to a 3rd party receiver). In these instances, theprocess may be simpler than when the broker acts as the intermediarywhen transmitting messages. Further, the process may be symmetric, witheither the client or the broker termed as the producer (e.g., the devicethat produces the message) and the consumer (e.g., the device thatreceives and consumes the message). Both the producer and the consumerknow the public keys of the other, which may be learned or obtained bythem during the connection initialization process, as discussedpreviously.

In one implementation, the sequence of transmitting the message betweenthe producer and the consumer may be as follows: the producer generatesmessage M0; the producer signs message M0 with its own private key,thereby resulting in signed message M1; the producer encrypts signedmessage M1 with the public key of the consumer, thereby resulting inencrypted signed message M2; the producer sends encrypted signed messageM2 to the consumer; the consumer receives encrypted signed message M2,decrypts it with its private key, thereby producing signed message M1;the consumer may then validate the signature of the producer in signedmessage M1, thereby extracting message M0 and resulting in the consumerobtaining the original message.

As discussed above, routing and/or meta information may be associatedwith the message subject to transmission. In one implementation, therouting and/or meta information used for the transmission is an objectof a protected header at an appropriate message level.

Further, authentication of certificates may be performed, as discussedabove. Various types of authentication are contemplated. As one example,X.509 authentication is performed.

In one implementation, the following steps are performed for X.509authentication:

(1) the certificate path is validated against known trust anchors, suchas according to RFC#4158 and RFC#5280;

(2) extended key usage is validated. In one implementation, thesignature and the encryption extended key usage (EKU) is present. Keyusage, which may define the purpose (e.g., encipherment, signature,certificate signing) of the key contained in the certificate, may alsobe present. In this regard, the key usage may be used when the key mightbe used for multiple operations and where it is desired to restrictusage of the key to a subset of the potential multiple operations. Inone implementation, the key usage may have “digitalSignature” forsigning and “keyEncipherment” for encryption. Prior to sending themessage, the sender may analyze at least one aspect of the key usage.For example, responsive to the sender determining that the receiver'scertificate does not have any key usage information, the sender mayrefuse to encrypt the message to send to the receiver. Alternatively, orin addition, the broker may filter out those certificates without keyusage information because messages for any receiver are to be encrypted.

(3) if sending a message to a specific group, the sender verifies therecipient has the specific group listed in the corresponding attribute(e.g., the certificate associated with the recipient indicates that therecipient is entitled to receive messages from the specific group).

(4) when sending a message to a destination, the sender may verifydestination value. In one implementation, the destination value isgoverned by ASN.1 definition of the value attribute. Specialdestinations have matching object identifier (OID), such as whereUpdateAgent (UA) destination uses the destination value matching thedestination. The rule for destination matching includes:

(4.a) convert the destination to an array of strings, where elements ofthe array are strings of the destination broken at the ‘/’ characters.Multiple ‘/’ characters will not create empty array points (which thearray points termed array A).

(4.b) convert the update agent address from the certificate into anarray in the same manner, with the array termed array B.

(4.c) iterate through both arrays of A and B, and compare elements ofboth arrays at the same index. If a comparison of an element fails, stopand skip the destination.

(4.d) if the array B is exhausted, stop and skip the destination.

(4.e) if the array A is exhausted, or both arrays of A and B areexhausted simultaneously, then the destination receives the message.

In one implementation, the system may address one or more types oferrors. Example errors include, but are not limited to any one, anycombination, or all of: low level errors; stream errors; timeout errors;and content errors. Other types of errors are contemplated.

Low level errors may arise from the following list of conditions:transport socket read/write error; and/or connectivity test timeout. Inone implementation, the response to a low level error is to disconnectthe transport channel and re-establish the connection. The frames thatfail CRC checksum may be silently discarded (which may result inout-of-sequence frames over reliable protocol; however, the probabilityof such events is very low).

Stream errors may result in the cancellation of a stream. Unless theinitialization itself fails (which may cause the connection to bedismissed), the response to the stream errors is to cancel the streamthat caused the errors or is the source of the error. The errorconditions include any one, any combination, or all of: timeout waitingfor a frame; encryption or signature verification error (which mayinclude the content errors (e.g., failed to parse security data),verification errors (e.g., mismatched hash, etc.), or authenticityerrors (e.g., expired certificate, no X.509 chain, etc.); frame out ofsequence (for reliable transports only, unreliable transports mayaddress missing frames at a transport adapter level).

With regard to timeout errors, examining the message exchanges discussedabove, for any messages that require a reply, a timeout may occurresponsive to not receiving such a reply within a predefined timeout.One example of such a reply is connectivity test messages.Alternatively, or in addition, there may be transport timeout, whenreceiving frames, such that each frame is not apart more than somepredefined timeout.

A content error may be detected by the calling application. Theapplication may not view streams; therefore, the application use its owntimeouts, and signaling mechanism for errors.

Further, as discussed above, the message may be sent in a variety offormats. As one example, the application messages may be in theJavaScript Object Notation (JSON) format. In particular, the top levelJSON artifact may be a JSON object. In this way, the messages expressedas JSON schema enables various devices, such as the broker, to accessthe information about the message.

Further, there may be several target devices within the vehicle (orother electronic environment) that may be subject to a software upgrade,such as discussed in co-pending U.S. patent application Ser. No. ______entitled “System and Method for Updating Software in an ElectronicDevice” filed on the same day as the present application, attorneydocket no. 014442-18017B-US, incorporated by reference herein in itsentirety. In one implementation, a single eSync Client Module is used tomanage the download of the software upgrade to the multiple targetdevices in the vehicle. For example, a single eSync Client Module maymanage software updates to any two, any three, or all four of thefollowing: telematics control unit (TCU); head unit; advanced driverassistance system (ADAS); or the controller area network (CAN) device.

In an alternate implementation, multiple eSync Client Modules are usedwithin the vehicle to perform the software upgrade. In this way, thevehicle may be configured as a multi-client architecture, with multipleeSync Client Modules used. Thus, in one implementation, the eSync ClientModules comprise software update modules. In practice, the differenteSync Client Modules may be assigned to different devices (or differentsets of devices) within the vehicles based on one or more factors. Forexample, the eSync Client Modules may be assigned to update differentdevices within the vehicle based on the type of functions performed bythe software of the target device (e.g., based on the type of devices,such as a UI device). As another example, the eSync Client Modules maybe developed for each OEM's custom vehicle network along with severaldownload agents which may be customized for each engine control unit(ECU) in the vehicle. In this way, the design of the multi-clientarchitecture is not limited by potentially differing networks; rather,the design may be based on the types of or functions performed by thedevices within a respective client.

In particular, one division may be based on the functions performed bythe software of the target device, such as critical functions (e.g.,related to safety) and non-critical functions (e.g., such asinfotainment). For example, criticality of a target device may be basedon the Automotive Safety Integrity Level. ASIL is a risk classificationscheme defined by the ISO 26262—Functional Safety for Road Vehiclesstandard. There are four ASILs identified by the standard: ASIL A, ASILB, ASIL C, ASIL D. ASIL D dictates the highest integrity requirements onthe product and ASIL A the lowest. In particular, ASIL D is the moststringent level of safety measures to apply for avoiding an unreasonableresidual risk, represents likely potential for severely life-threateningor fatal injury in the event of a malfunction, and requires the highestlevel of assurance that the dependent safety goals are sufficient andhave been achieved. Other divisions of the target devices arecontemplated.

In one implementation, all of the target devices within a specificdivision (e.g., ASIL D) may connect to nodes in a same specific networkwithin the vehicle (with the respective eSync Client Module alsoresiding in the same specific network or in a different network).Alternatively, or in addition, one, some or all of the target devicesmay connect to nodes in different networks within the vehicle, such asconnect to an Ethernet network, a CAN network, etc. (with the respectiveeSync Client Module also residing in the same network as a specifictarget device, or with the respective eSync Client Module residing in adifferent network than all of its target devices). Thus, in oneimplementation, the respective eSync Client Module may communicate withits respective group of target devices independent of the layout of thedevices amongst the different networks within the vehicle.

As discussed in more detail below, a first eSync Client Module may beassigned to update target devices that have a specific ASIL level (suchas ASIL D), and a second eSync Client Module may be assigned to updatetarget devices that have different specific ASIL level(s) (such as ASILA only or ASIL A-C). Thus, there is a separation of non-critical ASIL-Aand critical ASIL-D component for software updates. In turn, thearchitecture may configure separate update zones, defining the multidownload manager client architecture for the single vehicle (or otherelectronic environment).

As another example, a first eSync Client Module may be assigned toupdate target devices that have an ASIL A designation, a second eSyncClient Module may be assigned to update target devices that have an ASILB designation, a third eSync Client Module may be assigned to updatetarget devices that have an ASIL C designation, and a fourth eSyncClient Module may be assigned to update target devices that have an ASILD designation.

Each of the eSync Client Modules may perform any one, any combination,or all of the following independently of other eSync Client Modules: (1)connect to an external server in order to obtain the update software;(2) receive the update from the external server, which may include amanifest (including designations (such as non-address designationsand/or address designations) of the target devices subject to thesoftware update and the software update which may be included orassociated with the manifest); (3) after receiving the update from theserver, determine whether to begin the process of updating the softwarein the target device(s); (4) transmit (directly or via a broker,discussed below) the software update to the target devices; (5)determine whether the target devices have been properly updated; and (6)determine which target devices to roll back the software to a previousversion in the event that the target device(s) were not properlyupdated. For example, each eSync Client Module may connect to the serverindependently, may download the individual manifest and the payload(e.g., compressed or uncompressed), and may integrate with OEM's customdownload agents for target devices in the domain.

Alternatively, or in addition, one, some, or all of the eSync ClientModules may receive other types of communications (such as alerts, etc.)to send to their respective device(s). In this regard, the respectiveeSync Client Module may communicate with an external device (such as aserver) in order to obtain the communication, transmit the communication(e.g., directly or through a broker, as discussed below), with therecipient target device residing in the same network as other targetdevices that receive the communication or a different network as othertarget devices that receive the communication, and/or with the recipienttarget device residing in the same network as its respective eSyncClient Module (that sends the communication) or residing in a differentnetwork than its respective eSync Client Module.

In one implementation, the multi-eSync Client Module architecture may bearranged as mutually exclusive domains, as discussed in more detailbelow. Thus, the various functions performed by the eSync Client Modulesin the different domains are entirely separate and not dependent at allon one another. Example functions that an eSync Client Module mayperform include, but are not limited to: (1) connecting to an externalserver in order to obtain the update software; (2) receiving the updatefrom the external server; (3) after receiving the update from theserver, determining whether to begin the process of updating thesoftware in the target device(s); (4) transmitting (directly or via abroker, discussed below) the software update to the target devices (orto a node proximate to the target device in the event that the targetdevice does not have an update agent); (5) determining whether thetarget devices have been properly updated; and (6) determining whichtarget device(s) to roll back the software to a previous version in theevent that the target device(s) were not properly updated. The eSyncClient Module, separate from operations related to software updates, maylikewise communicate messages to various devices, such as in therespective domain.

For example, the multi-eSync Client Module architecture may beconfigured in a critical domain (with the eSync Client Module(s) withinthe critical domain managing devices deemed as critical (e.g., ASIL Ddevices)) and in a user domain (with the eSync Client Module(s) withinthe user domain managing devices deemed as non-critical (e.g., ASIL A-Cdevices)). In one implementation, the managed devices within arespective domain may be in a same network (with the respective eSyncClient Module being in that same network or a different network).Alternatively, or in addition, the managed devices within a respectivedomain may be in different networks (with the respective eSync ClientModule being in one of the different networks or in an entirelydifferent network). Thus, the various functions, including thedownloading of the software update, the decryption of the softwareupdate, the decompressing of the compressed delta, the adding of thedecompressed delta to the existing version of software to obtain the newversion of software, and the flashing of the new version of thesoftware, may be performed independently for the different eSync ClientModules in the different domains.

In an alternate implementation, the multi-eSync Client Modulearchitecture may be arranged as dependent domains, as discussed in moredetail below. For example, a single target device (such as an ECU) mayhave certain functions in the critical domain and other functions in theuser domain. In this way, there are interdependent elements within eachof the critical and user domains.

In the interdependent multi-client architecture, one, some, or all ofthe following may be performed interdependently of other eSync ClientModules including: (1) connecting to an external server in order toobtain the update software; (2) receiving the update from the externalserver; (3) after receiving the update from the server, determiningwhether to begin the process of updating the software in the targetdevice(s); (4) transmitting (directly or via a broker, discussed below)the software update to the target devices (or to a node proximate to thetarget device in the event that the target device does not have anupdate agent); (5) determining whether the target devices have beenproperly updated; and (6) determining which target device(s) to rollback the software to a previous version in the event that the targetdevice(s) were not properly updated. For example, the timing as to whenthe eSync Client Modules connect to the external server in order toobtain the update may be interdependent. In one implementation, a mastereSync Client Module may determine when the follower eSync ClientModule(s) connect to the external server. In an alternateimplementation, the eSync Client Modules negotiate amongst themselves todetermine when to connect to the external server.

Likewise, after receiving the software update from the server, thetiming of when to begin the process of updating the software in thetarget devices may be interdependent. In one implementation, a mastereSync Client Module may determine when the follower eSync ClientModule(s) begin the process of updating the software in the targetdevices.

Further, the determination as to which target devices to roll back thesoftware to a previous version in the event that the target device(s)were not properly updated may be interdependent. In one implementation,a master eSync Client Module may determine which of the follower eSyncClient Module(s) (including whether for all follower eSync ClientModules) to roll back the software to the previous version in the eventthat the target device(s) were not properly updated. In an alternateimplementation, the eSync Client Modules negotiate amongst themselves todetermine which target devices to roll back the software to the previousversion. Alternatively, or in addition, separate from which targetdevice(s) to rollback, the timing of the rollback may likewise beinterdependent. In one implementation, a master eSync Client Module maydetermine when the follower eSync Client Module(s) (including whetherfor all follower eSync Client Modules) are commanded to roll back thesoftware to the previous version in the event that the target device(s)were not properly updated.

For example, because of this interdependence, the version of thesoftware that is updated through the critical domain and the version ofthe software that is updated through the user domain may besynchronized. In the event that the software update in one domain failsto update, then both update agents may revert back to an older workingversion of the software (e.g., the version of the software prior to thelatest software update).

In still an alternate implementation, the multi-eSync Client Modulearchitecture may be arranged as dependent domains for certain functionsand independent domains for other functions. As discussed above, variousfunctions include, but are not limited to: downloading the softwareupdate; decrypting the software update; decompressing the compresseddelta; adding the decompressed delta to the existing version of softwareto obtain the new version of software; flashing the new version of thesoftware (e.g., storing the new version of the software intonon-volatile memory); and determining whether to roll back to a previousversion of the software in response to an error in any point in theprocess (e.g., an error in adding the decompressed delta to the existingversion of software or in flashing the new version of the software). Asone example, the multi-eSync Client Modules may operate independentlyfor all functions except for the determining whether to roll back to theprevious version.

In one implementation, the respective eSync Client Module maycommunicate directly with the target devices. Alternatively, therespective eSync Client Module may communicate indirectly (via a broker)with the target devices. As discussed above, using a broker relieves thedifferent devices, such as the eSync Client Module, from knowing theaddress of the target devices, as further discussed below.

Referring to the figures, FIG. 1 illustrates a block diagram 100 offunctional devices within a vehicle and a proprietary businterconnecting the functional devices. As discussed above, one examplesystem comprises an in-vehicle system. Alternatively, other types ofsystems, such as for a building, are contemplated. In that regard, thediscussion with regard to the in-vehicle system may likewise be appliedto other types of systems.

As shown, vehicle 110 includes eSync Client Module 112, policy 114,status 116, gateway (GW)+Certificate Management 118, broker 120, and oneor more ECUs (such as ECU 1 (130), ECU 2 (132), ECU 3 (134), and ECU N(136). Though 4 ECUs are depicted in FIG. 1, fewer or greater numbers ofECUs are contemplated. eSync Client Module 112 and ECU 1 (130), ECU 2(132), ECU 3 (134), ECU N (136) are examples of eSync agents, which maycommunicate with broker 120. The various eSync agents may communicatevia one or more types of buses. In one implementation, one, some or allof the buses in vehicle 110 communicate via a proprietary type of busprotocol, such as the eSync bus protocol. As discussed in further detailbelow, broker 120 may comprise the intermediary through which devices,such as eSync Client Module 112 and the one or more ECUs communicate. Asshown, eSync Client Module 112 may communicate with other electronicdevices (not shown) via cloud 102. As discussed further below, the otherelectronic devices may comprise servers, such as command servers orsoftware update serves, in order to control various electronic devicesin vehicle 110.

One, some, or all of blocks depicted in FIG. 1 may comprise functionalblocks configured to perform a function. As one example, broker 120 maycomprise a functional block configured to perform the brokerfunctionality, as discussed in more detail below. In this regard, in oneimplementation, the broker 120 may reside in an electronic device withinvehicle 110 that further houses other functional blocks. As anotherexample, a same electronic device (such as a gateway server resident inthe vehicle) may execute the functionality for both the broker 120 andeSync Client Module 112. In one implementation, the same electronicdevice may execute multiple processing threads, with differentprocessing threads for executing the broker functionality and the eSyncClient Module functionality, respectively.

One, some, or all of the functional blocks (including eSync ClientModule 112, broker 120, and ECUs) depicted in FIG. 1 may include anyone, any combination, or all of: (1) a certificate for verification ofthe functional block (e.g., the certificate may establish the origin ofthe respective functional block to validate the functional block byanother functional block); (2) a private key for the functional block,with the private key being generated by the same entity that generatethe certificate in (1); and (3) a trust anchor or authority thatverifies authentication for other participants (e.g., functionality toverify certificates of other functional blocks).

As discussed further below, one, some, or all of the devices withinvehicle 110 may establish a channel with the broker 120. For example,one or both of the ECUs or eSync Client Module 112 may establish anindividual channel to broker 120, which may already be provisioned inthe component prior to installation. Prior to establishing a channel,validation of at least one party (or both parties) to the channel arevalidated. In particular, one, some, or all of the devices in vehicle110 may be provisioned with a certificate (such as provisioned with acertified upon manufacture). One, some, or all of the devices in vehicle(except for broker 120) may include information to communicate withbroker 120 (such as a default address of broker 120), which may be usedto register with broker 120. As discussed in further detail below,during registration and in order to establish a channel, the broker 120and the electronic device, such as ECU 1 (130) or eSync Client Module112, may perform mutual validation. For example, broker 120 may request(or receive unprompted) from the electronic device the electronicdevice's certificate, and validate the certificate of the electronicdevice as indicating that the electronic device is allowed tocommunicate via the broker. Likewise, the electronic device may request(or receive unprompted) from the broker 120 the broker's certificate,and validate the certificate of broker 120 as indicating that broker 120is allowed to communicate via the electronic device.

Thereafter, subsequent to registration, the channel may be established.Various security measures may be established for the respectivechannels, such as by generating a random session key for the electronicdevice registered with broker 120, with subsequent communications forthe channel via broker 120 for the electronic device (either as a senderor a recipient) using the session key. For example, the ECUs may bepreprogrammed (via a programmed address for the broker 120 (e.g., aconfigured port address and IP address of broker 120), discussed below)to communicate with the broker 120 in order to establish the channel.Once the channels are established, any devices with a respective channelmay exchange information via the broker 120 using the eSync busprotocol. As one example, the eSync Client Module 112 and one, some orall of ECU 1 (130), ECU 2 (132), ECU 3 (134), and ECU N (136) mayexchange information. In this regard, any two components that haveestablished channels via the eSync bus protocol may exchangeinformation.

Further, even though FIG. 1 does not illustrate an update agent, anupdate agent may be present in vehicle 110, such as present in an eSyncClient module, an ECU or in a gateway (see FIG. 3). One, some, or allupdate agents in the vehicle may be associated with a default groupmembership for exchanging messages (e.g., unique addresses).

One, some or all eSync Agents are provided with a respective certificateduring instantiation and the respective eSync agent may be assignedmembership subscription as indicated by the respective certificateassociated with the respective eSync agent. This membership defineswhich type of messages on the bus the node associated with therespective eSync agent is privy to. Further, as discussed below,membership to groups may be changed (added or deleted) for a respectiveeSync agent based on changing the respective certification for therespective eSync agent (e.g., using GW+Certificate Management 118). Inpractice, broker 120 may know how to route messages to specific groups,but does not have the capacity to decipher messages being routed. Inthis regard, the messages are transparent to broker 120. In this regard,the configuration looks like the Application level VLAN, which isagnostic to the physical interfaces, and provides isolation, such as todifferent bus types (e.g., USB, Ethernet, CAN). Broker may simply at asa post office, directing the messages it receives to the specificaddresses (e.g., broker 120 may parse a message it receives, identifyone or more eSync agents to receive the messages, and then route themessage to the identified one or more eSync agents. Further, there is noneed for multicast as Groups can be used to listed to specificaddresses. Broker may examine a message in order to determine all thedevices that are entitled to receive the message, and then route themessage to the determined devices.

In a specific implementation, security for the channel may compriseSSL/TLS security. In particular, SSL/TLS uses a combination of publickey and symmetric-key encryption. Symmetric-key encryption is muchfaster than public-key encryption, but public-key encryption providesbetter authentication techniques. An SSL/TLS session may begin with anexchange of messages called the SSL handshake, with the initialcommunication between the server and client. The handshake therebyallows the server to authenticate itself to the client using public-keytechniques, then allows the client and the server to cooperate in thecreation of symmetric keys used for rapid encryption, decryption, andtamper detection during the session that follows. Key-exchangealgorithms like RSA and Elliptic Curve Cryptography (ECC) govern the waythe server and client determine the symmetric keys to use during an SSLsession. The most common SSL cipher suites use RSA key exchange, whileTLS supports ECC cipher suites as well as RSA. A Certificate Systemsupports both RSA and ECC public-key cryptographic systems. Thus, asecurity key may be established using RSA between any two connectionpoints.

In one implementation, in-vehicle network nodes may share EncryptedPayload using AES. The key is symmetric and is shared for a sessionahead of time only between verified nodes. The session key may be validfor a predetermined amount of time or during a predetermined event(e.g., lasting for 24 hours after creation or for the time betweenengine power ups). The TLS session may be established between Server andeSync Client Module. Further, HMAC+AES may be used to sign and encryptpayload inside the vehicle. In this regard, a device may encrypt thepayload and sign the payload.

As illustrated in FIG. 1, each connection to the broker is anindependent connection. A specific device's membership (such as an ECU'smembership) with broker 120 may be established through the use ofassigned certificates during configuration or initial flash prior toinsertion into network. In this regard, the different channels betweenthe broker and respective devices represent logical independentconnections.

Separate from establishing the channels between respective electronicdevices and broker 120 (such as a first channel between eSync ClientModule 112 and broker 120, a second channel between ECU 1 (130) andbroker 120, etc.), validation to send and/or receive the communicationmay be performed. As one example, the sender of the communication may bevalidated prior to a device (such as broker 120) allowing the sending ofthe communication. In particular, a sender, such as eSync Client Module112 or ECU 1 (130), may seek to send a communication. Prior to sendingthe communication, another device, such as broker 120, may determinewhether to authorize the sending of the communication. In oneimplementation, broker 120 may perform the authorization. Further, inone implementation, the authorization (such as performed by the broker120) may take one of several forms including any one, any combination orall of: (i) determining whether the sender is generally authorized tosend a communication; (ii) determining whether the sender is authorizedto send a type of communication (such as an alert communication, asoftware update communication (e.g., a software delta), etc.); (iii)determining whether the sender is authorized to send a communication toa specific recipient (e.g., whether eSync Client Module 112 isauthorized to send a communication to ECU 1 (130)); and/or (iv)determining whether the sender is authorized to send a communication toa type of recipient (e.g., whether eSync Client Module 112 is authorizedto send a communication to any type of ECU). Responsive to theauthorization of the sender, the broker 120 may send one or more aspectsof information to the sender. For example, in response to the brokerdetermining that the sender is authorized to send a communication to aspecific recipient, the broker 120 may send a certificate associatedwith the specific recipient. Thereafter, the sender may communicate, viathe broker 120, in order to validate itself to the specific recipient.Further, in one implementation, the specific recipient may likewisecommunicate, via the broker, in order to validate itself with thesender. As another example, in response to the broker determining thatthe sender is authorized to send a communication to a type of recipient,the broker 120 may determine all of the devices that are of that type(e.g., all devices that are ECU) and send the certificate(s) andoptionally the listing of all of the devices of that type (e.g., alisting of all the ECUs currently registered in the vehicle).

Alternatively, or in addition, the recipient of the communication may bevalidated prior to a device (such as broker 120) allowing the receipt ofthe communication. In particular, a recipient, such as eSync ClientModule 112 or ECU 1 (130), may be indicated recipient of a communicationthat broker 120 is tasked to route. Prior to broker 120 routing thecommunication sent from sender, broker 120 may determine whether theindicated recipient is authorized to receive the communication. In oneimplementation, the authorization performed by broker 120 may take oneof several forms including any one, any combination or all of: (i)determining whether the recipient is authorized to generally receive acommunication; (ii) determining whether the recipient is authorized toreceive a type of communication (such as an alert communication, asoftware update communication (e.g., a software delta), etc.); (iii)determining whether the recipient is authorized to receive acommunication from a specific sender (e.g., whether ECU 1 (130) isauthorized to receive a communication from eSync Client Module 112;and/or (iv) determining whether the recipient is authorized to receive acommunication from a type of sender (e.g., whether ECU 1 (130) isauthorized to send a communication from any type of eSync Clientmodule).

In practice, one electronic device subject to the information exchange(such as the eSync Client Module 112) may use a key (such as a randomkey (e.g., session key) which is not initially known to the otherelectronic device subject to the information exchange (e.g., ECU 1(130), ECU 2 (132), ECU 3 (134), and ECU N (136)). So that, anyelectronic device (or both of the electronic devices) subject to theinformation exchange (e.g., ECU 1 (130), ECU 2 (132), ECU 3 (134), andECU N (136)) may send a request to the other electronic device (e.g.,eSync Client Module 112) to provide its public key (e.g., eSync ClientModule provides its public key). As one example, only one device of thetwo devices may be validated in order to generate the session key. Forexample, the requesting device (e.g., an ECU) may verify the origin ofthe provided key (e.g., verify the origin of the eSync Client Moduleprovided public key). Responsive to the verification, the requestingdevice (e.g., the ECU) may then send the session key using the Publickey of the requesting device. As another example, both devices may bevalidated in order to generate the session key. In a specific examplebetween an ECU and the eSync Client Module 112, one of the ECU or theeSync Client Module 112 may send the initial communication to the otherdevice to establish the session key. After validation of the key by theother of the ECU or the eSync Client Module 112, the other of the ECU orthe eSync Client Module 112 may then send its key to the one of the ECUor the eSync Client Module 112 for validation. After which, the sessionkey may be generated.

In this regard, respective session keys may be established for eachindependent connection. For example, a first session key may beestablished from eSync Client Module 112 to ECU 1 (130), a session keymay be established from eSync Client Module 112 to ECU 2 (132), a thirdsession key may be established from eSync Client Module 112 to ECU 3(134), etc.

Thus, the session key, valid only until a predetermined amount of timeand/or even. In this regard, the session key is not simply exchangingkeys amongst different devices in the vehicle 110. Rather, generatingthe session key involves a specific process of handshaking/validationamongst the different devices. As one example, if ECU 1 (130) seeks tocommunicate (e.g., receive and/or send messages) with eSync ClientModule 112, ECU 1 (130) may send a message to broker 120, with themessage indicating to broker 120 that ECU 1 (130) wishes to communicatewith eSync Client Module 112. In one implementation, the message fromECU 1 (130) may include the certificate of ECU 1 (130). In response toreceiving the message, broker 120 forwards the certificate for ECU 1(130) to eSync Client Module 112. In response to the forwarded message,eSync Client Module 112 reviews the certificate of ECU 1 (130) anddetermines if the certificate is valid to receive messages from eSyncClient Module 112. As one example, after broker 120 authorizes eSyncClient Module 112 and ECU 1 (130) for registration, broker 120 simplyacts to route communications between eSync Client Module 112 and ECU 1(130) (and optionally may route keys to devices in vehicle 110). Inparticular, eSync Client Module 112 may access the key (e.g., the publickey) of ECU 1 (130) (e.g., that ECU 1 (130) forwarded to broker 120) andthen generates a random session key and send it back to the ECU 1 (130)(via the broker 120). Thereafter, communications that are encrypted withthe public key of ECU 1 (130) can be decoded by ECU 1 (130). In thisregard, there's a division of labor whereby broker 120 acts as therouter but does not perform the certification analysis based on the ECU1 (130) public key, whereas eSync Client Module 112 does not performrouting but does perform the certification analysis and does generatethe session key based on the public key of ECU 1 (130).

FIG. 2 illustrates a first block diagram 150 of devices for updatingsoftware in a vehicle. Specifically, FIG. 2 illustrates an OEM server160 with a software repository of revisions (e.g., delta updates) 162.The OEM server 160 is in communication with software update server 170such as in order for the software update server to fetch updates (e.g.,delta updates) or sync with the OEM server 160. After synching, softwareupdate server 170 includes a synched repository of revisions (e.g.,delta updates) 172.

Software update server 170 communicates with vehicle 180 via wiredand/or wireless protocols, such as via HTTPS. Further, as discussed inmore detail below, various electronic devices within the vehicle 180 maycommunicate with one another. One type of electronic device is thetarget device(s) 190, which is/are the device(s) subject to the softwareupdate. Examples of the target device(s) 190 include, but are notlimited to, engine control unit (ECU) 192, telematics control unit (TCU)194, and/or head unit (HU) 196. Other devices subject to softwareupdates are contemplated. Within the vehicle, communications may use oneor more protocols, such as eVAB (Ethernet Audio Video Bridging), DoIP(Diagnostics over IP), ODX (Open Diagnostics eXchange), SOME/IP(Scalable service Oriented MiddlewarE over IP), or UDS (UnifiedDiagnostic Services). Other communication protocols are contemplated.

FIG. 2 illustrates a second block diagram 200 of software componentsused for updating software in a vehicle. In particular, the softwareupdates may comprise various components 210 (such as updates) in theform of component (COM) P-1 212, COM P-2 214, COM P-N 216. Any number ofcomponents are contemplated. The components may be transmitted to acampaign block 220, which may schedule the various components for updateon the vehicles 180. Specifically, adaptive delta update 222, discussedfurther below, may organize one or more packages (package 1 226, package2 228, etc.), and using policy filters (such as vehicle lists, policiesfor updates, filters, and dependencies), perform the scheduling of theupdates using scheduler 240.

FIG. 3 illustrates a third block diagram 300 of devices for updatingsoftware in a vehicle. Test equipment 310 may communicate directly withcloud 320 and/or vehicle client 350. Cloud 320 may include over-the-air(OTA) campaigner 322, configured to manage the over-the-air updates, anddiagnostic server 324, configured to monitor the software updates anddiagnose and/or correct failures in the software updates.

Vehicle client 350 is configured to interface with various systems inthe vehicle. For example, vehicle client 350 may communicate directlywith certain vehicle devices via a Controller Area Network (CAN) bus. Asillustrated in FIG. 3, vehicle client 350 communicates with ECU 1 (364)and ECU 2 (366) via the CAN bus. Various types of ECUs are contemplated,such as a Uniform Diagnostic Service (UDS) compliant ECU and/or an OEMspecific ECU.

Alternatively, or in addition, the vehicle client 350 may communicatewith other devices within the vehicle via subnets 352. Specifically,subnets 352 may communicate with one or more gateways, such as DoIPgateways 342, 346, 356, 360, via Ethernet. Each of the DoIP gateways342, 346, 356, 360 may have update agents (UA) 344, 348, 358, 362.

Update agents may be used to implement the software update in a device.For example, ECU 9 (330) includes update agent 332, and thus need notuse update agent 344 in DoIP gateway 342. However, ECU 10 (334) does notinclude an update agent, and may thus rely on update agent 344 in DoIPgateway 342 to perform a software update for software resident in ECU 10(334). Similarly, ECU 11 (336) includes update agent 338, but ECU 12(340) does not, instead relying on update agent 348 in DoIP gateway 346to perform a software update for software resident in ECU 12 (340).Likewise, ECU 3 (368), which includes update agent 369, and ECU 4 (370),which does not include an update agent, communicates via the CAN buswith DoIP Gateway 356. ECU 5 (372) and ECU 6 (374), which includesupdate agent 375, communicates via the CAN bus with DoIP Gateway 360.Finally, DoIP node (376), which includes update agent 378, and DoIP node(380), which includes update agent 382, communicates via Ethernet withSwitch 354.

The update agent may be configured to support the software upgrade andinstallation (e.g., automated patch delivery and installation) and mayperform any one, any combination, or all of: receive the softwareupdate; decrypt the software update; decrypt the software update; andinstall the software update. In instances where the software update isdivided into sections, the software update may manage the process,including receiving an indication as to the section of software to usewith the delta to recreate the image of the software in memory andinstalling the recreated image into the volatile and/or non-volatilememory. As discussed below, certain devices (such as ECU 3 (UDS) 368)have an update agent instantiated within. In this regard, these certaindevices may perform the installation of the software upgrade.Alternatively, other devices (such as ECU 4 (UDS) 370) do not have anupdate agent instantiated within. In this instance, these other devicesmay rely on an update agent instantiated in a nearby node to perform anyone, any combination or all of decryption, decompression, recreation ofthe image prior to saving of the software upgrade in the target device.

Though broker is not illustrated in FIG. 3, broker may be present invarious blocks illustrated, such as in DoIP gateway 342, 346, 356, 360.In this regard, the functionality ascribed to broker may likewise beimplemented in a system as illustrated in FIG. 3.

FIG. 4 is a first block diagram 400 of in-vehicle gateway components. Inparticular, OTA server 402 communicates with vehicle client 410. Vehicleclient 410 may comprise eSync Client Module 420, local secure storage412, access eSync tree 414, flash memory 416, HMI service 432, securemessage server 434, and system status agent 436.

eSync Client Module 420 comprises various sub-elements including FUMOcommunicator 422, DM node API 424, schedule/process handler 426, gatewayupdate agent 428, and insurance kernel 430. Vehicle client 410communicates with vehicle agents 440, including update agents 442, anddiagnostic agents 444. Though broker is not illustrated in FIG. 4,broker may be present in various blocks illustrated, such as in vehicleclient 410.

FIG. 5 is a second block diagram 500 of a network architecture usingmultiple gateways. OTA server 402 communicates with various componentswithin vehicle 501, including Gateway—1 (540). In this regard, Gateway—1(540) acts as a conduit to the OTA server 402, relaying communicationsto different devices, such as Gateway—2 (550). Various devices withvehicle 501 may communicate with Gateway—1 (540) including: headunit512, 1Gb camera 514, 100 Mb cameras 516, heads-up display (HUD) 518,on-board diagnostics (OBD) 520, local interconnect network (LIN) 522,media server port (for USB) 542, one or more sensors (e.g., for Radar)544, and one or more CAN ECUs 546, 548.

Likewise, various devices with vehicle 501 may communicate withGateway—2 (550) including: 1Gb cameras 524, 100 Mb displays configuredto receive a rear image (e.g., for a backup camera) 526, radio 528,Advanced Driver Assistance Systems (ADAS) 530 (e.g., adaptive cruisecontrol, blind spot detection, collision avoidance systems, forwardcollision warning, etc.), media server port (for USB) 552, and one ormore CAN ECUs 554, 556, 558. Though broker is not illustrated in FIG. 5,broker may be present in various blocks illustrated, such as ingateway—1 (540) and/or gateway—2 (550).

FIG. 6 is a third block diagram 600 of an in-vehicle gateway for anelectric vehicle. eSync Client Module (eSync Client Module) 610 may beplaced in any high computing ECU in a connected network, such as beingintegrated with another electronic device within the vehicle (e.g.,incorporated into smart antenna or telematics control unit (TCU) 612).Smart antenna or telematics control unit (TCU) 612 may communicate withan Ethernet gateway 630, which in turn may communicate with otherdevices, such as steering wheel actuator ECU 620, in-car entertainment(IVI) headunit 640 (which is in turn provides communication via a USBport to a USB media module 642), ADAS front camera 650 (e.g., foradaptive cruise control, collision avoidance systems, forward collisionwarning, etc.), ADAS rear camera 660, vehicle body CAN gateway 670(which in turn is in communication with body control ECU 680 and enginecontrol ECU 690). Though broker is not illustrated in FIG. 6, broker maybe present in various blocks illustrated.

FIG. 7A is a block diagram illustrating recovery procedures responsiveto disruptions from the server to the vehicle and within devices in thevehicle. Specifically, block diagram 700 illustrates transmissiondisruptions (e.g., a connection failure) between the Cloud Software OverThe Air (SOTA) server 710 communicating with vehicle client gateway 720.The download may be cached in a buffer in a device within the vehicle,such as in a headunit. Further, responsive to a transmission disruption,the last partial download may be resumed.

FIG. 7A further illustrates transmission disruptions within the vehicle,such as between vehicle client gateway 720 and one or more componentswithin the vehicle, such as critical component 730 and non-criticalcomponent. In the event of an update disruption between vehicle clientgateway 720 and critical component 730, one or both of vehicle clientgateway 720 and critical component 730 may retry performing the softwareupdate using the update agent, as discussed herein. In the event ofcorruption of the update, the critical component 730 may be rolled backto a previous software version using insurance kernel 430. In the eventof an update disruption between vehicle client gateway 720 andnon-critical component 750, one or both of vehicle client gateway 720and non-critical component 750 may retry performing the software updateusing the update agent. In the event of corruption of the update, thesoftware update may be downloaded again; after which, the update agentmay attempt to perform the installation of the software update. In thisregard, the configuration enables a highly fault tolerant and fail-safesystem

FIG. 7B is a block diagram 760 illustrating Software Over-the-Air (SOTA)for manufacturing in bootstrap mode. The bootstrap mode may comprise theprocess of initiating the first programming of the devices in a vehiclewhile the vehicle moves along an assembly line. The OEM server 764 maycommunicate with ECU provider(s) 762 in order to obtain the uploadsoftware, dependencies, revisions etc. for the specific model of thevehicle (e.g., the update software for upload to the vehicle). Further,the OEM server 764 may save the upload to a memory, such as softwarerepository revisions, delta 766, which may store the various revisionsof software that may be resident in the vehicle, including the softwaresubject to upload and previous versions of the software, and the deltasfor transmission to the vehicle. The OEM server 764 may communicate witheSync Cloud SOTA Server 770, which may itself communicate with a memory,such as software repository revisions, delta 774, which may likewisestore the various revisions of software that may be resident in thevehicle, including the software subject to upload and previous versionsof the software, and the deltas for transmission to the vehicle 780.Further, test equipment 772 may be used to mimic the same communicationprotocols used to program vehicles from the Cloud SOTA server. Theseprotocols may include DOIP, SOME/IP, DOCAN, UDS, etc. The interface fromthe cloud to the vehicle ECUs may be simulated or implemented using testequipment just as well. In particular, test equipment may comprise theprimary method for flashing the ECUs in the assembly line in absence ofa cloud server arrangement.

FIG. 8 is a block diagram 800 of security from the cloud to within thevehicle. Server 810 may include user authorization 812, app server 814,revocable private key, multi-factor authentication (MFA), database 818,and eSync engine 820. Vehicle 830 includes eSync Client Module 832,message broker 834 (an example of broker 120), and one or more updateagents 836. In practice, eSync Client Module 832 communicates with eSyncengine 820, such as via Hyper Text Transfer Protocol Secure (HTTPS) orSyncML (Synchronization Markup Language). Further, eSync Client Module832 communicates with message broker 834 via one or more buses, such asvia the bus protocol disclosed herein or via another type of busprotocol (e.g., security may be as established by the eSync busprotocol, such as Transport Layer Security (TLS) 1.2, which may beestablished between message broker 834 and eSync Client Module 832, andmessage broker 834 with any other device). In turn, message broker 834communicates with one or more update agents 836, such as illustrated inFIG. 3, which in turn may communicate with other devices, such as anECU, a gateway or other modules 838.

Thus, in one implementation, the peer encryption (e.g., the encryptionby the sender for the final recipient destination) may be as follows:

When the sender is composing the message, the sender may have a list ofbus addresses to deliver the message to. Rather than query the recipientdirectly, the sender may query the broker to obtain one or moreidentification information associated with the recipient. In oneimplementation, the identification information comprises the list ofcertificates matching the destination addresses of the recipients (whichmay be received as list of certificate fingerprints). For eachfingerprint, the sender may have a certificate that matches thefingerprint. If one or more certificates are not found, the sender mayissue a certificate request to the broker, and wait until allcertificates are received. All received certificates may be fullyauthenticated, and authorized for delivery to at least one of thespecified address. In one implementation, the address deliveryvalidation is performed even for a cached certificate (e.g., in someimplementations, the broker may not be trusted to return certificatehashes for authorized destinations).

Various types of addressing schemes are contemplated in order toidentify an electronic device (e.g., for identifying a sender of or arecipient to a communication). In one implementation, a uniqueidentifier may be associated with the electronic device. Alternatively,or in addition, the electronic device may be associated with a group ofdevices. As one example, a tree address structure may be used toidentify one or a group of devices, such as illustrated in FIG. 9.

Specifically, FIG. 9 illustrates a classic binary tree address structurewith various nodes indicative of different elements within a vehicle.For example, a vehicle may have one or more types of ECUs, including anEngine Control Module (ECM), a Powertrain Control Module (PCM), aTransmission Control Module (TCM), a Brake Control Module (BCM or EBCM),a Central Control Module (CCM), Central Timing Module (CTM), a GeneralElectronic Module (GEM), a Body Control Module (BCM), a SuspensionControl Module (SCM), or the like. Taken together, these systems may bereferred to as the vehicle's computer, though typically, the computingfunctionality may be divided either logically or physically in differentelements. Further, one assembly may incorporate several of theindividual control modules (e.g., the PCM may be both for control of theengine and the transmission).

The hierarchical tree address structure may be used for addressing ofvarious types of messages (e.g., software update messages/commands,status message, error message, query command, rollback command/message,user interface (UI) message, etc.). For example, a command may includethe receiver identifier as “/gw*”. In one implementation with the “*indicative of a wild card meaning all the messages below that addresslevel are received by the subscriber, the receiver identifier as “/gw*”may include all nodes in the hierarchical tree address structure under“/gw”, such as “/gw/ECU1”, “/gw/ECU2”, “/gw/ECU1/BDC”, “/gw/ECU2/TCM”.Thus, an endpoint may claim any number of hierarchical addresses, suchas, for example, /root1/point1, /root2, /root3/point1/sub4. With thisexample, such an endpoint will receive all messages with destination toeither of /root1/point1/*, /root2/* and/root3/point1/sub4/*, with theuse of the wild card (*). This may allow representation of addresses ina tree-like manner, and have destinations in a message (such as acontrol message) that are intended for multiple lower-level devices thatmay not be able to participate in the eSync bus protocol.

In an alternate implementation, the receiver identifier may send a treestructure message, with an indication therein of the node identified and1 level of the tree structure below the indicated node (e.g., “/gw!” mayindicate “/gw”, “/gw/ECU1”, “/gw/ECU2”). Alternatively, a separatearrangement may indicate the recipient as only a single node in the treeaddress structure (e.g., /gw/ECU1/BDC to only address the BDC module).

In still another implementation, an electronic device may set asecondary address for a primary address so that all messages that go tothe secondary address also go to the primary address. For example,/gw/ECU1/BDC with secondary /gw indicates that all messages that go to/gw should also go to /gw/ECU1/BDC (with the secondary address being/gw). As another example, a single endpoint may declare to receivemessages for both “/tbox” and “/gw”; in response, the single endpointwill receive messages for both the addresses that start with “/tbox” and“/gw”. In this regard, the electronic device may either filter themessages (e.g., only receive messages directly addressed to therespective electronic device) or additional subscriptions may be added,thereby increasing the number of messages that go to a node based onindicating a secondary address.

Thus, in one implementation, a respective address, such as for thebroker or the eSync Client module, may be a constant value, such as aninteger exact match, which is defined once and cannot be changed.Further, a string-based address may be used for groups, so that anynumber of groups may be used. Finally, a tree-like string value forUpdate Agents, such as illustrated in FIG. 9, allows for hierarchicaldelivery. In one implementation, the broker may send an indication ofthe devices registered. For example, the broker may send to an eSyncClient Module the hierarchy, such as that displayed in FIG. 9, whichdoes not include the addresses. Instead, the eSync Client Module mayreceive the string address (e.g., /gw/ECU2, thereby indicating that ECU2is part of gw). In this way, the eSync Client Module may learn of theexistence of electronic devices registered to the broker.

Separate from the hierarchical tree address structure, routing may bebased on a type of message. As discussed above, various types ofmessages are directed to alerts, updates, rollbacks, UI, etc. Thecertificate may indicate allowance to receive certain types ofmessage(s). In this regard, the message may indicate its respectivetype, with the broker (or other routing device) reviewing the respectivetype and accessing a table or other data construct that correlatesrespective types of messages with recipient(s) previously validated ashaving associated certificate(s) granting access to the respective typeof message, in order to route the message with the respective type toelectronic devices previously validated to receive messages of therespective type.

One or more devices may determine the recipient electronic devices asindicated in a command. In one implementation, broker 120 may analyzethe indication of the recipient electronic devices indicated in thecommand, and determine which recipient electronic device to send thecommand to. For example, responsive to receive a command to route, withthe command indicating “/gw” (indicating the node/gw and all nodesunderneath), the broker may perform the determination as to whichrecipient devices to route the message to.

In one implementation, address subscriptions may be performed duringcertificate provisioning. In this regard, any change to the addressingmay necessitate a new certificate. This type of dynamic provisioning ofthe certificates may be performed, such as by GW & CertificateManagement 118 in the system as shown in FIG. 1. Specifically, GW &Certificate Management 118 may revoke a certificate and change themessage subscription for any node. Thus, in one implementation, separatefrom identifying a group of recipient electronic devices, a device (suchas one or both of the sender electronic device or the broker) mayvalidate whether one, some, or all of the electronic devices in thegroup of recipient electronic devices are allowed to receive thecommunication. As one example, the sender may wish to send an “Alert”message, and may determine whether the certificates for the respectiverecipient electronic device(s) indicate that the respective recipientelectronic device(s) should receive “Alert” messages. As anotherexample, in-vehicle infotainment (IVI) may wish to send a communicationto all the nodes including and beneath/gw. Separate from identifying allof the nodes for receipt of the communication, in one implementation,the IVI may then validate, based on the certificate from the respectiverecipient electronic device, whether the respective recipient electronicdevice is allowed to receive the communication from the specific sender(IVI). In this regard, certification (which may associate a functionalelement to a subscription of messages) may be dynamically programmed ormodified on a device, such as an ECU, to modify membership privilegesbased on some a priori information in the system. Thus, for a functionalelement to change the subscription (either to reduce or to addsubscription of message) may be performed by changing the certificationassociated with the functional element.

Alternatively, or in addition to the sender node validating thecertificates of the recipient(s), one, some or all of the nodes in thehierarchical tree address structure may perform an intelligent voluntarydetermination whether to receive messages. In particular, a respectiverecipient electronic device may, based on its certificate, be allowed toreceive certain types of messages (e.g., alert messages, etc.) toreceive messages from certain types of senders, etc. For example, a UIdevice may have a respective certificate that indicates being allowed toreceive UI messages. The respective recipient electronic device mayperform an analysis, such as its memory and/or processing capabilities,to determine whether to request amending of the certificate in order tostop receiving certain type(s) of message (even though under the currentcertificate, the respective electronic device has subscribed to thosecertain type(s) of messages). For example, an ECU may determine that itsprocessor usage is getting beyond a certain limit. Responsive to thisdetermination, the ECU may seek to restrict the number of messages it isprocessing to the limited number that it absolutely needs (e.g., requestthe GW & Certificate Management 118 to issue a new certificate toindicate fewer messages it is allowed to receive (e.g., the ECUcertificate is amended so that the ECU is no longer allowed to receivealert messages).

The sender may choose a key for each destination, based on thefingerprint of the destination certificate. In one implementation, thekey (such as an AES content key) is randomly generated using a securerandom algorithm, and is rotated every predetermined amount of time(e.g., 24 hours) or every predetermined event (e.g., turning on thevehicle).

Each message may be encrypted with the key (such as the randomlygenerated AES content key). In one implementation, the JWx library mayperform this function when the selected key management is a key wrap.Thus, in one implementation, the content key is wrapped with thedestination key, and in the case of multiple destinations, the contentkey may be wrapped multiple times.

Each destination key may be referenced using a key ID (KID), with thevalue of KID being:

Let A=SHA-256 fingerprint of the source (sender's) certificate (samevalue as used in x5t#S256, but in binary form)

Let B=SHA-256 fingerprint of the destination certificate (same value asused in x5t#S256, but in binary form)

Let K=destination key

Let KID=Base64 (ABSHA-256(ABK)) (“ ” operation is the concatenation ofbinary strings)

The CJOSE encryption may comprise:

alg—AxxxKW (such as A256KW)

enc—AxxxCBC-HSyyy (such as A256CBC-HS512)

Thus, the message may be encrypted with the key (such as the public keyor the private key) of the destination. In one implementation, a certainset of messages are encrypted with the public key of the destination. Inthis case, the following CJOSE values may be used:

enc—AxxxCBC-HSyyy (such as A256CBC-HS512)

alg—RSA1_5, RSA-OAEP, or RSA-OAEP-256

Key identification may be performed using a web signature, such as aJSON Web Signature (X.509 Certificate SHA-256 Thumbprint: x5t#5256)

Alternatively, or in addition, another set of messages may be encryptedwith the private key of the destination. In this case, the followingCJOSE values may be used:

alg—RSxxx (such as RS256)

Key identification may be performed using: x5c (e.g., if it reasonableto believe that the destination does not have the certificate of thesender); or x5t#S256 (e.g., if the destination is expected to know thecertificate of the sender).

In one implementation, the recipient device performs peer decryption(e.g., the decryption by the recipient from the original destination).As discussed above, messages received from the original destination areencrypted. The receiver may iterate through available KIDs, and find the(first) KID that matches the fingerprint of its public key. If none arefound, the message may be discarded, and stream may be aborted.

The receiver may look up the certificate matching the fingerprint of thesender. If such certificate is not found, the receiver may request thecertificate from the broker using the request certificate detailsmessage. Once received (e.g., certificate details message), therecipient may authenticate the certificate, and may store theauthenticated certificate for future look-ups.

The recipient may further access, based on the KID, the destination key.If the key for the KID is not found, the recipient may request it fromthe broker using the request key message. The recipient may hold ontothe original message until the key is received. Responsive to sendingthe request key message, the broker sends the key response message,which may contain the key.

In one implementation, the key response message includes certainattributes, including any one, any combination, or all of:

(i) key response message is encrypted using public key of the recipient;

(ii) key response message is signed using the private key of the sender;

(iii) key response message may first have been encrypted, and thensigned; and

(iv) the public key of the sender matches the fingerprint of the requestmade.

In one implementation, if any of (i)-(iv) is not satisfied, therecipient discards the message, and the stream aborted. Otherwise, therecipient extracts the destination key from the key response message,and uses the extracted destination key to decrypt the incoming messagebefore passing it to the application. In one implementation, theauthorization of the message is performed from the correspondingcertificate of the sender, as was determined during key look-up process.The message is therefore considered trusted, because encryption may haveincluded hash-based message authentication code (HMAC) authenticationalong with it.

Once a new key has been received for the same pair of sender/receiverpublic key, the new key information may be requested, and may beretained for all such keys. In one implementation, keys may be retiredafter a predetermined time (e.g., if the key has been created more than25 hours ago) and/or after a predetermined event (e.g., responsive tothe vehicle being turned oft).

As discussed above, prior to a client-sender sending messages via theeSync bus protocol, the client-sender establishes a connection with thebroker. In one implementation, the establishment of the connection withthe client may comprise one, or both, of the broker authorizing theclient and/or the client authorizing the broker. With regard to thebroker authorizing the client, when a client connects to the broker, thebroker may establish that the client is authorized to use eSync businfrastructure. In one implementation, the broker may perform theauthorization of the client by performing any one, any combination orall of:

the broker signing its first outgoing message with its private key;

the registration request of the client is signed with the private key ofthe client, and is encrypted with the public key of the broker;

the broker determines whether the certificate used in the registrationrequest sent from the client to the broker includes the necessaryauthorization to communicate via the eSync bus;

a separate key is also present in the registration request, with theseparate key being used as a session key for further messages (asdiscussed above, in one implementation, the session key may be validonly for a certain period of time (e.g., 25 hours after initialissuance) and/or until a certain event occurs (e.g., re-starting thevehicle).

Thereafter, all further messages from client to the broker may be signedwith the following CJOSE parameters: alg—HSxxx (such as HS256); and keyalg—“dir”.

Conversely, the client may verify the broker. In this regard, whenconnecting to the broker, the client may receive an algorithm messagefrom the broker. The client may determine whether the algorithm messageis signed by the private key of the broker. If not, the connectionrequest may be denied. Further, the client may determine whether thecertificate, used by the broker and included in the message, isvalidated for broker authorization. As discussed above, the client maygenerate a random AES key for signing the message to the broker, anddeliver it in the registration request.

In addition, messages thereafter from the broker are to be signed withthe same CJOSE parameters as expected by the broker. Similar to above,the client regenerates the session key every predetermined time period(e.g., every 24 hours) or after a predetermined event, and sends a newregistration request, with that registration request signed with thepublic key of the client, and encrypted with the private key of thebroker.

Initialization:

As part of the initialization process, the client device may registerwith the broker.

In one implementation, only after registration of the client device iscompleted (e.g., registration confirmation is fully sent), the brokermay send other messages to the client device. Further, the client devicemay not send any normal messages before the registration is finished.For connectionless transports, an external mechanism for guaranteeddelivery may be used during the initialization phase (though it may notbe necessary for normal operations). Finally, the presence message maycontain “connected” information on all currently connected clients. Forexample, in one implementation, the presence message may include, foreach connected device, an identifier and a corresponding address.Alternatively, or in addition, the presence message may include, foreach disconnected device, an identifier and a corresponding address. Anexample of this process is illustrated in the flow diagram of FIG. 10A.

In practice, at least one of the broker or client device may initiatethe connection in order to begin the registration process. In oneimplementation, at 1001, the client device may initiate the connection(e.g., based on the broker address being pre-programmed upon manufactureof the client device). For example, the broker may be at a generic IPaddress in the vehicle, with the generic IP address assigned by a givenOEM. In this regard, with a fixed topology, the broker may be assigned afixed address. Alternatively, auto discovery may be used in order toestablish the connection with the broker. As one example, the broker maytransmit a broadcast message requesting all devices that are notcurrently registered to respond. In particular, multicast or broadcastmessages may indicate where the broker sits. For example, SOME/IPincludes discovery provisions, whereas ARXML description carries staticaddress for configuration.

As discussed above, various algorithms may be used including, withoutlimitation, RS256, RS384, and RS512. Further, one or both of the clientdevice and the broker may send a registration request. The registrationrequest may include various items, such as various keys (e.g., a sessionkey).

Thus, the initial connection from the client device to the broker mayinclude one or more of the following: (1) an indication of the requestby the client device to register with the broker; and (2) a certificateassociated with the client device. Alternatively, the client device maysend the certificate in a separate communication from the initialconnection message. In still an alternate implementation, the clientdevice may send its respective identification indication, with thebroker communicating with an external certificate authority in order toobtain the certificate associated with the client device.

At 1002, the broker may analyze the certificate associated with theclient device. At 1003, the broker may determine, based on the analysis,whether the certificate is valid. If not, at 1004, the broker rejectsregistration of the client device. If so, at 1005, the broker registersthe client device. Registration of the client device may comprise anyone, any combination, or all of: registering the address of the clientdevice; determining association of the client device with one or moregroups (e.g., alert message group (indicative that the client device isto receive alert messages), UI message group (indicative that the clientdevice is to receive UI messages), etc.); or determining hierarchicalassociation of the client device (e.g., a determining where the clientdevice is positioned in the hierarchy, such as illustrated in FIG. 9, inorder to determine the routing of messages such as discussed above). Thebroker's registration may result in a table or other data construct thatcorrelates the registered data (e.g., correlates the indication of theclient device to the one or more groups).

Alternatively, or in addition, the client device may validate thebroker. Similar to the discussion above, the client device may obtainthe certificate of the broker (such as received directly from the brokeror from a certificate authority). The client device may then determinewhether the certificate is valid. If not, the client device may refusefurther communication with the broker, and if so, the client device mayaccept further communications from the broker.

As discussed above, after a client has registered with the broker, theclient may send messages under what is termed normal operations. In oneimplementation, one, some, or all messages under normal operations areencrypted for their final destinations. To be able to encrypt messageswith the keys of all of the recipients, the sender of the message maydiscover the connected recipients before sending each message. Asdiscussed further below, the sender of the message may discover theconnected recipients by communicating with the broker. Further, thesender of the message may communicate with the certificate bodies forthose certificates that have not been seen previously (or werepreviously disposed of) in order to validate those certificates.

Various sequences for sending a message are contemplated. Oneimplementation flow diagram 1009 is detailed in FIG. 10B. At 1010, thesender requests destinations from the broker. As discussed above,different address types are contemplated, such as special addresses,update agent addresses, group addresses, etc.

Responsive to sending the destination request, the broker may send thedestinations. Further, at 1011, the sender may access/analyze thecertificates associated with the recipient(s) of the message. Forexample, responsive to the sender determining that it does not have acertificate associated with a certain recipient, the sender may requestthe certificate from another device, such as a certification authority.Responsive to receiving/accessing the certificate details, at 1012, thesender may authenticate at least one aspect of the certificate. As oneexample, the sender may authenticate the certificates for each of thedestination addresses that the respective destination address isauthorized for delivery. Responsive to a certificate being invalid, at1013, the sender does not send the message to recipient(s) whoseassociated certificate is not considered valid.

In one implementation, the sender may send the message as is, withoutthe message being wrapped. Alternatively, at 1014, the sender may selecta content key (e.g., session key) for each destination address based onthe fingerprint of the destination certification, and at 1015, thesender may encrypt message with the content key (e.g., with the contentkey being wrapped with the destination key). After which, at 1016, thesender sends the encrypted message to broker with the list ofdestination addresses.

The broker may then receive the message, with the broker delivering themessage to the recipient(s), as illustrated in flow diagram 1020 of FIG.10C. At 1021, the recipient receives the message from the broker. At1022, the recipient accesses the certificate associated with the sender(which may be obtained from the certificate authority or from thebroker). At 1023, the recipient may authenticate at least one aspect ofthe certificate. As one example, the recipient may authenticate thecertificate for the sender is authorized to send the message. Responsiveto a certificate being invalid, at 1024, the recipient rejects themessage from the sender. If the certificate is deemed valid, at 1025,the recipient accesses the content key, and at 1026, decrypts themessage with the content key.

FIG. 10D illustrates a flow diagram 1030 another example of a sendersending a message to the recipient via the broker. Flow diagram 1030assumes that the sender has the public key(s) of the receiver and thatthe sender is sending private message S0. At 1030, sender encrypts themessage with the public key(s) of the receiver, creating JWE message S1.Optionally, private message S0 may be compressed first, with the JWEstandard supporting compressing the original body as part of encryption.

At 1031, sender signs S1 with its own private key, creating JWS messageS2. At 1032, sender adds routing information to S2. At 1033, senderencrypts S2 with the public key of the broker, creating JWE message S3.At 1034, sender sends S3 to the broker.

At 1035, broker receives S3 and at 1036, decrypts it with its privatekey, which must produce S2 (or results in a failure). At 1037, brokerexamines S2 for the destination(s), and the following steps apply pereach recipient (1038): at 1039, broker encrypts S2 with the public keyof the respective recipient, generated message S4; at 1040, brokerdelivers S4 to the respective recipient; at 1041, respective recipientdecrypts S4 with its private key, which must produce S2 (or results in afailure).

At 1042, the respective recipient verifies signature of S2, and at 1043,extracts S1 if validation succeeds. At 1044, respective recipientdecrypts S1 with its private key, obtaining S0.

As discussed above, keys may be sent between the sender and the broker(such as the sender requesting a key from the broker, and the brokerrequesting a key from the sender), and between the recipient and thebroker (such as the recipient requesting a key from the broker, and thebroker requesting a key from recipient). Separate from sending a messagefrom the sender to the recipient via the broker, the client device maycommunicate with the broker. For example, when broker seeks to send amessage to the client device, or the client device seeks to send amessage to the broker itself (e.g., not using the broker as anintermediary for sending a message to a receiver), the process issimpler than depicted in FIG. 10D. Further, in one implementation, theprocess may also be symmetric. For terminology, one may designate eitherthe client device or broker as producer and consumer. In oneimplementation, each device must know the public keys of the other,which may be learned during the connection initialization process (e.g.,the client device previously sent its public key to the broker duringinitialization and vice-versa). FIG. 10E illustrates a flow diagram 1050of the client device-broker communication. At 1051, producer generatesmessage M0. At 1052, producer signs M0 with its own private key,generating M1. At 1053, producer encrypts M1 with the public key of theconsumer, generating M2. At 1054, producer sends M2 to the consumer. At1055, consumer receives M2. At 1056, consumer decrypts it with itsprivate key, generating M1. At 1057, consumer determines whethersignature in M1 is valid. If so, at 1058, consumer extracts M0, with theconsumer now having the original message for use by the consumer. Ifvalidation fails, at 1059, consumer may reject the message.

FIG. 11 illustrates a sequence diagram for broker authentication andtransmission of keys, with a subsequent software update routed to anendpoint device. In particular, ECU #N may request authentication frombroker, with the request for authentication including ECU #Ncertificate. In response to receiving the request (and ECU #Ncertificate), the broker may verify the authenticity of the ECU #Ncertificate. If the broker verifies the authenticity of the ECU #Ncertificate, the broker may update its subscription list, which asdiscussed above may include any one, any combination, or all of: themessage(s) that ECU #N is allowed to receive; the groups that ECU #N isassociated with; the placement of ECU #N in the tree hierarchy; etc. Thebroker may further send a communication to ECU #N notifying ECU #N ofverification. If so, ECU #N may send its key (such as its public key).

Further, broker may send the identification associated with ECU #N alongwith the public key of ECU #N. In one implementation, broker may sendthis message (including the identification associated with ECU #N alongwith the public key of ECU #N) as part of a presence message to alldevices currently registered with broker (e.g., responsive to the brokerregistering a device (or a set of devices), the broker may push apresence message to the currently registered devices). In anotherimplementation, broker may send this message responsive to a requestfrom a specific device, such as a request from eSync Client Module forpresence information (e.g., responsive to eSync Client Module receivinga software update for ECU #N, eSync Client Module may request thepresence message from broker).

Thereafter, eSync Client Module may receive a software update for ECU#N. eSync Client Module encrypts the software update for ECU #N usingthe public key of ECU #N, and transmits the encrypted software update tobroker. Broker receives the encrypted software update, and routes thesoftware update to ECU #N using the subscription list generated duringregistration of ECU #N. Upon receipt, ECU #N decrypts the encryptedsoftware update using its private key.

After a client device is registered with the broker, the client devicemay request to disconnect from the broker, as illustrated in flowdiagram 1060 in FIG. 10F. At 1061, the client device sends a disconnectrequest to the broker. At 1062, the broker acknowledges the disconnectrequest sent from the client device. At 1063, the broker terminates theconnection. The termination of the connection may comprise any one orall of: removing the client device from lists managed by the broker fordelivering messages; and sending a presence message indicating that theclient device has terminated the connection.

Further, in one implementation, the client device may perform aconnectivity test. In particular, the client device, within certainintervals, may conduct the connectivity test (such as when theunderlying connection requires to do so). Alternatively, a client devicemay select not to perform the connectivity test; the client device maysimply incur a higher risk of encountering a dead connection when theclient device seeks to send a message. The connectivity test maycomprise the following sequence: participant 1 sends a ping toparticipant2; participant2 sends a pong to participant1. The clientdevice may only perform the connection test responsive to the clientdevice determining that there has been no data received from theconnection within a certain amount of time.

Separate from connectivity test, a presence message may be sent. Forexample, when a new client connects to, or disconnects from the broker,the presence information may be distributed to one, some or all otherconnected clients. The sequence may comprise the broker sending thepresence message to all of the other connected clients.

In one implementation, the broker may aggregate multiple presence eventsinto a single presence message, such as combining multiple presenceevents by new clients into the single presence message, or waiting tosend the single presence message until presence events cancel each otherout (e.g., one client device is added and one client device isdisconnected). In one implementation, the broker may wait no longer thana predetermined amount (e.g., no more than 1 second) when combiningmultiple presence events.

In one implementation, the broker may treat connection eventsdifferently from disconnect events. For example, the broker mayaggregate or buffer multiple connections with the same address, and notissue disconnect events; however, the broker may always issue connectevents. In this implementation, when a new client is connected, thebroker sends a presence message on that new client regardless. However,there may be multiple clients with the same group, special address, orupdate agent address. If one, then another update agent with the sameaddress connects, between presence messages, the broker may generate aconnection event. If only one client device disconnects, the broker doesnot issue a disconnect event; rather, in one implementation, the brokeronly issues a disconnect event for an address when there are no moreclients for that address. This may create an imbalance in the amount ofconnect and disconnect events, which is envisioned.

As discussed above, various forms of authentication, such as X.509authentication, may be used. When authenticating X.509, the followingmay be performed:

(1) the certificate path is validated against known trust anchors,according to RFC#4158 and RFC#5280.

(2) extended key usage is validated, eSync Bus signature and eSync Busencryption extended key usage (EKU) may be present respectively (OIDbase 1.3.6.1.4.1.45473.3). Key usage may also be present, and may have“digitalSignature” for signing and “keyEncipherment” for encryption Thesender may refuse to encrypt the message if the receiver's certificatehas no necessary KU. The broker may also filter those certificates outbecause messages for any receiver will be encrypted.

(3) if sending a message to a group, the sender may verify the recipienthas group listed in the corresponding attribute (1.3.6.1.4.1.45473.1.7).

(4) When sending a message to a destination, verify destination value.Value is governed by ASN.1 definition of the value attribute. Specialdestinations have matching OID, where UpdateAgent destination uses thedestination value matching the destination. In one implementation therule for destination matching in:

(a) have the destination be converted to an array of strings, whereelements of the array are strings of the destination broken at the ‘/’characters. Multiple ‘/’ characters should not create empty array points(termed array A).

(b) have the update agent address from the certificate be converted intoarray the same way (termed array B).

(c) iterate through both arrays of A and B, compare elements of botharrays at the same index. If a comparison of an element fails, stop andskip the destination.

(d) if the array B is exhausted, stop and skip the destination.

(e) if the array A is exhausted, or both are exhausted simultaneously,then the destination may receive the message.

As discussed above, the message broker may comprise the intermediary interms of routing messages. In this regard, there may be concerns ofhaving the broker, acting in this messaging role, may be a securitythreat unless the broker is deemed trusted. Additionally, the broker mayinclude a permissions table, thereby taking the ability to make suchdecisions away from the end-points.

In order to reduce the security issue, the authentication andauthorization may be shifted from the transport protocol to the messagepayload (e.g., through encryption), as discussed above. As discussedabove, the communication that the broker receives from the senderincludes different sections, such as an envelope (that the broker hasaccess to) and the payload or message (that the broker does not haveaccess to, such as the payload or message being encrypted with a publickey of the recipient or the session key).

Nevertheless, the possibility still exists for an entity to receive amessage that is not intended for it (such as a message that is arequest). In order to reduce this possibility, the broker may have acollection of certificates from peers. In this regard, when a peerintends to send a message to another peer, the peer validates thecertificate, then encrypts the message with a symmetric key, encryptsthe key with the public key of the validated recipient(s), and thentransmits the message, as discussed above. Thus, in this case, the SSLmay no longer be necessary, as the application protocol takes care ofthe encryption as well as authentication and authorization (though itmay still use X.509). This is in contrast to a broker-less system, whichrequires a discovery mechanism (such as an IP broadcast or multicast) todiscover other devices in the system.

FIG. 12A is a block diagram 1100 of independent dual domains within avehicle. As illustrated in FIG. 12A (and in FIGS. 12B and 13A-B,discussed below), the vehicle includes multiple domains, with each ofthe domains including at least one eSync Client. For example, asillustrated in FIGS. 12A-B and 13A-B, the vehicle is classified intoseparate domains of critical and non-critical. Further, in oneimplementation, the eSync Client devices may manage electronic devicesthat are mutually exclusive of one another (see FIG. 12A and FIG. 13A).Alternatively, the eSync Client devices may manage electronic devicesthat not mutually exclusive of one another (see FIG. 12B and FIG. 13B).This is unlike solutions in which the entire vehicle includes a singleeSync Client architecture, which may be vulnerable to attack and hencemay be less secure. In this regard, in one implementation, amulti-client approach is used.

As discussed further below, the multi-client approach may increase thecomplexity of control and/or synchronization management. As one example,the multi-client approach addresses failures in the different stages ofthe software process in different ways. As an initial matter, thedifferent stages of the software process include, but are not limitedto: (1) communication with the OTA server; (2) performing a softwareupdate; and (3) completing the software update. As discussed in moredetail below, failures may occur at the different stages including: (i)losing connection with the OTA server prior to download of all of theupdates to the eSync Clients (including the master eSync Client device(also termed a master software update module) and/or the follower eSyncClient device(s) (also termed follower software update modules)); (ii)losing connection with the OTA server after download of all of theupdates to the eSync Clients (including the master eSync Client deviceand/or the follower eSync Client device(s)), but prior to verificationto the OTA server that the downloads have been installed and completed;or (iii) failure in the installation process of the software update forone, some or all of the eSync Clients.

As discussed in more detail below, one of the eSync Clients, such as themaster eSync Client device and/or the follower eSync Client device(s),may resolve the failures, including: in response to a communicationdisruption with the OTA server, determining whether and/or when toresume last partial download; and determining whether the softwareupdate has been implemented, and determining what actions to take inresponse to a failure in implementing the software update (e.g., whetherto roll back to a previous software version for one, some, or all of thetarget devices that the eSync Client device controls).

Further, the timing of the failures may determine the course of actiontaken by the master eSync Client device. With regard to a failure todownload the update, the master eSync Client device may determinewhether the failure is considered a short-term failure or a long-termfailure. For example, a first set of the eSync Client devices (e.g., thefirst half of the eSync Client devices) have received the download ofthe update whereas a second set of the eSync Client devices (e.g., thesecond half of the eSync Client devices) have not received the downloadof the update. Responsive to the master eSync Client device determiningthat the failure, resulting from an inability to connect to the serverin order to perform the download of the updates, is less than apredetermined amount of time (e.g., 1 day), the master eSync Clientdevice may determine that the failure is short-term. Because the failureis deemed short-term, the master eSync Client device may continueattempting to download for the second half of the eSync Client devices,and will not perform a re-download for the first half of the eSyncClient devices. Responsive to the master eSync Client device determiningthat the failure to connect to the server in order to perform thedownload of the updates is greater than or equal to the predeterminedamount of time (e.g., 1 day), the master eSync Client device maydetermine that the failure is long-term. Because the failure is deemedlong-term (which may indicate that even the downloads that have alreadybeen received may be out-of-date, such as for the first half of theeSync Client devices), the master eSync Client device may attempt toperform the download for all of the eSync Client devices, including thefirst half of the eSync Client devices where the downloads have alreadybeen received. In this way, in the event that a newer download updatehas been issued for the first half of the eSync Client devices, the newdownload update may be obtained.

With regard to a failure to update the flash, the master eSync Clientdevice may likewise determine whether the failure is considered ashort-term failure or a long-term failure. If the master eSync Clientdevice determines that there have been fewer than X number of times thatthe update to flash has been tried and failed, the master eSync Clientdevice may consider the failure a short-term failure. If the mastereSync Client device determines that there have been X number of times orgreater that the update to flash has been tried and failed, the mastereSync Client device may consider the failure a long-term failure, mayroll back the software, and may send a report of the defect to theserver.

FIGS. 12A and 12B illustrate different types of multi-clientarchitectures. As illustrated in FIG. 12A, the multi-client architecture1200 includes two domains in the vehicle, including the critical domain1230 and user domain 1250. The number of domains shown in FIGS. 12A-Band 13A-B are merely for purposes of illustration. Two, three, four, ormore domains may be present within the vehicle. As a general matter, thedifferent domains in the vehicle may be managed by an electronic device,such as each domain having a respective eSync Client device. In thisregard, the architecture, with the separate domains, may be used forisolation of different electronic portions of the vehicle.

In FIG. 12A, the critical domain 1230 and user domain 1250 are mutuallyexclusive to one another. This is illustrated in FIG. 12A as the securedomain gateway 1232 in the critical domain 1230 being isolated from theIVI head unit 1252 in the user domain 1250. For example, the functionsperformed by one domain are entirely independent of the other domain.Functions include, but are not limited to and one, any combination, orall of: downloading software updates (such as software delta(s));decompressing the software updates; decrypting the software updates;reconstructing the image; and storing the reconstructed image innon-volatile memory. Thus, the separate domains may be controlledcompletely separately and independently. For example, all aspects,including download of the software update, decompression of the softwareupdate, decryption of the software update, preparing/flashing softwareupdate, rolling back the software update (in the event of a failure inthe software update), may be performed independently for each domain. Inparticular, the OTA updates to each of the critical domain 1230 and theuser domain 1250 may be performed separately. Further, one OTA updatemay reach both of the critical domain 1230 and the user domain 1250. Inaddition, failure of one or more functions in one domain may notinterfere with OTA to another of the domains. For example, failure indownload of the OTA to the user domain 1250 may not affect the downloadin the critical domain 1230.

Alternatively, only certain aspects of the software update process maybe performed independently whereas other aspects of the software updateprocess may be performed dependently. For example, a first domain mayperform the download, decompression, decryption, and preparing/flashingof the software update independently of a second domain. However, therollback of the software update (in the event of a failure in performingthe software update) in the first domain may be performed dependently onthe whether there was a failure in the software update in the seconddomain, as discussed further below. In this regard, the separate domainswithin the vehicle may operate independently for certain functions, anddependently for other functions (in order for the domains to besynchronized).

Authentication may first be established between Cloud Server 1210 andthe radio unit (TCU) 1220, which may use switch 1222, using TLS1.2security protocol. In practice, both the critical domain 1230 and userdomain 1250 may request downloads from cloud server 1210. Specifically,each of the critical domain 1230 and user domain 1250 may include arespective eSync Client, with the respective eSync Client controlling(or being involved in some manner, such as overseeing) the variousfunctions in the software update process including downloading,decompressing, decrypting, reconstructing and/or storing. Thus, botheSync Client—1 (1234) (an example of a first software update module) andeSync Client—2 (1256) (an example of a second software update module)may request downloads and the cloud server 1210 can send a single packetto the TCU (Telecomm Unit) in the radio unit (TCU) 1220. Further, in oneimplementation, each of eSync Client—1 (1234) and eSync Client—2 (1256)are configured to update only the electronic devices within itsrespective domain. Further, in one implementation, the network layoutfor the critical domain 1230 is different from the network layout forthe user domain 1250 (such as one of the domains including a pluralityof networks, such as CAN, while the other does not). Alternatively, thenetwork layout for the critical domain 1230 and the user domain 1250 isthe same.

In FIG. 12A, secure domain gateway 1232 may comprise eSync Client—1(1234). Likewise, in-vehicle infotainment (IVI) head unit 1252 maycomprise an eSync Client—2 (1256). As shown in FIG. 12A, the eSyncClient may reside within an electronic device subject to a softwareupdate, such as IVI head unit 1252 (which includes update agent 1254).As shown in FIG. 12A, eSync Client—1 (1234) is instantiated in securedomain gateway 1232 and eSync Client—2 (1256) is instantiated in IVIhead unit 1252. Alternatively, the eSync Client may reside within anelectronic device not subject to a software update, such as securedomain gateway 1232. In devices that are subject to an update (and thathave the capability to perform the software update), an update agent(UA) is present within the device in order to perform the softwareupdate. Thus, both eSync Client—1 (1234) and eSync Client—2 (1256) mayrequest downloads. In response to the requests, cloud server 1210 maysend a single packet to the TCU (Telecomm Unit).

After download, the different domains may use different paths to thetarget device for the software update. For example, the critical domain1230 may use a path, such as CAN, with a higher level of security toControl ECU 1238 (which may have critical function software residenttherein) than the path used in user domain 1250 to send software updatesfrom IVI head unit 115 to surround view (CAM) park assist 1260 (whichincludes update agent 1262 and which may have non-critical functionsoftware resident therein).

FIG. 12B is a block diagram 1270 of dependent dual domains within avehicle. As illustrated in FIG. 12B, at least one target devicetranscends both the critical domain 1280 and the user domain 1290. Inparticular, ECU 1288 transcends both the critical domain 1280 and theuser domain 1290, wherein the control of ECU 1288 is administeredthrough eSync Client—1 (1284) in secure domain gateway 1282.Specifically, a portion of ECU 1288 (e.g., control aspects of the ECU1288, such as AUtomotive Open System ARchitecture) is controlled viaeSync Client—1 (1284) in the critical domain 1280. Conversely, otherparts of ECU 1288 are administered through eSync Client—2 (1295) in IVIhead unit 1292 (which includes update agent 1294). One aspect ofnon-critical control in ECU 1288 may comprise a camera display (such assurround view (CAM) park assist). This is one example in whichinterdependent elements within a single device (such as ECU 1288) may bemanaged by multiple eSync Client devices. Thus, in one implementation,eSync Client—1 (1284) may be configured to update the software, workingin combination with update agent 1286, for the critical functionalaspects of element 1288 (such as control ECU), and eSync Client—2 (1295)may be configured to update the software, working in combination withupdate agent 1296, for the non-critical functional aspects of element1288 (such as surround view (CAM) park assist). This division of theupdates may necessitate synching of the updates.

Thus, in one implementation, the version of the software that is updatedthrough the critical domain and the version of the software that isupdated through the user domain are to be in sync. In practice, if onedomain update fails, then both update agents 1286, 1296 revert back tothe older working version of the software. For example, in the eventthat update agent 1296 in user domain 1290 fails to perform the softwareupdate, eSync Client—2 (1295) may receive notice of this failure. Inturn, eSync Client—2 (1295) may notify eSync Client—1 (1284) of thefailure. In one implementation, eSync Client—1 (1284) may determine thatbecause there was a failure in an update to the non-critical part of ECU1288, the entire ECU 1288, including the update to the critical part ofthe ECU 1288, is rolled back to a previous version. In this regard,eSync Client—1 (1284), in the role of master eSync Client, may ordereSync Client—2 (1295) update agent 1296 to roll back to the previousversion of software for the non-critical part of ECU 1288.Alternatively, even in response to eSync Client—1 (1284) receive noticeof failure to update in the non-critical domain (such as user domain1290), eSync Client—1 (1284) may determine to command roll back only tothe non-critical part of ECU 1288 (such as surround view (CAM) parkassist), but not to the entire ECU 1288 (such as the update to thecritical part of the ECU (Control ECU (AUTOSAR))).

As another example, in the event that update agent 1286 in criticaldomain 1280 fails to perform the software update, eSync Client—1 (1284)may receive notice of this failure. In one implementation, eSyncClient—1 (1284) may determine that because there was a failure in anupdate to the critical part of ECU 1288, the entire ECU 1288, includingthe update to the non-critical part of the ECU 1288, is rolled back to aprevious version. In this regard, eSync Client—1, as the master eSyncClient, (1284) may order eSync Client—2 (1295) update agent 1296 to rollback to the previous version of software for the non-critical part ofECU 1288. Alternatively, even in response to eSync Client—1 (1284)receive notice of failure to update in the critical domain 1280, eSyncClient—1 (1284) may determine to roll back only to the critical part ofECU 1288, but not to the entire ECU 1288 (such as the update to thenon-critical part of the ECU 1288).

FIG. 13A is a block diagram 1300 of independent dual domains within avehicle where each independent domain includes a broker through whichcommunications within the respective domain communicate. In particular,each respective domain, including critical domain 1330 and user domain1350 has a respective broker (critical domain broker 1332 and userdomain broker 1352). Alternatively, more than one broker may reside ineach domain. As discussed above, within an architecture, one or morebrokers may be present. In the implementation illustrated in FIG. 13A,the devices within the critical domain, including eSync Client—1 (1234)and Control ECU 1238, may be pre-programmed with the address of criticaldomain broker 1332 in order to register with critical domain broker1332. Likewise, the devices within the user domain, including eSyncClient—2 (1256) and surround view (CAM) park assist 1260, may bepre-programmed with the address of user domain broker 1352 in order toregister with user domain broker 1352. As discussed above, the brokermay reside in one of several places, including in a standalone device orwithin another device (such as illustrated in FIG. 13A, where criticaldomain broker 1332 resides within secure domain gateway 1232.

In practice, after registration, eSync Client—1 (1234) may send amessage to critical domain broker 1332 in order communicate with ControlECU 1238. As discussed above, eSync Client—1 (1234) need not know theaddress of Control ECU 1238, only its designation (such as indicated inthe certificate of Control ECU 1238), and vice-versa.

FIG. 13B is a block diagram 1370 of dependent dual domains within avehicle where each dependent domain includes a broker through whichcommunications within the respective domain communicate. In particular,each respective domain, including critical domain 1380 and user domain1390 has a respective broker (critical domain broker 1382 and userdomain broker 1392). As discussed above, within an architecture, one ormore brokers may be present. In the implementation illustrated in FIG.13B, the devices within the critical domain, including eSync Client—1(1284), may be pre-programmed with the address of critical domain broker1332 in order to register with critical domain broker 1332. Likewise,the devices within the user domain, including eSync Client—2 (1295), maybe pre-programmed with the address of user domain broker 1392 in orderto register with user domain broker 1392.

In one implementation, a device that transcends multiple domains may bepre-programmed with the address of the respective brokers for therespective domains, including ECU 1288 pre-programmed with the addressof critical domain broker 1332 and user domain broker 1392 in order tocommunicate with brokers residing in separate domains. Alternatively, adevice that resides within multiple domains may only communicate with abroker in one domain. In this way, the separate domains are isolated interms of communication. However, in the event that a communication needsto be sent between domains, such as from a master eSync client device toa follower eSync client device, the master eSync client device maycreate an exception thread to communicate with the follower eSync clientdevice. The exception thread may comprise a message link but not a datalink in order to determine status or control (e.g., the master eSyncclient device pols the follower eSync client device to determine whetherthe follower eSync client device received the update and if so, thefollower eSync client device may send a response to the master eSyncclient device accordingly; the master eSync client device pols thefollower eSync client device to determine whether the follower eSyncclient device completed the update and if not, the follower eSync clientdevice may send a response to the master eSync client deviceaccordingly, whereby the master eSync client device will command therollback).

As discussed above, using a multi-client architecture may present uniquechallenges. For example, one challenge in the multi-client architectureis state synchronization between the various different clients. In oneimplementation, the clients are mutually exclusive and have their uniquedata requirements for their update payloads. This is particularlyimportant when eSync Client devices come from multiple suppliers.

Further, the software update process may result in a variety of types offailures. One type of failure relates to a connection failure. Forexample, the system, with multiple clients, may determine how to addressan intermittent or poor wireless connection to the vehicle eSync Clientdevice from the Cloud Server. Another type of failure is at the updateagent. For example, when an update agent determines that there is afailure in the software update (such as a failure in updating thesoftware in the ECU), the system may perform a synchronized rollback ofthe software or synchronized updates.

Apart from these general type of problems, the software update processhas specific problem use cases including: only a part of the eSyncClient devices that have interdependent modules (such as illustrated inFIGS. 12B and 13B) have new payloads downloaded and connectivity tocloud server 1210 is lost; all the eSync Client devices have payloadsdownloaded and connectivity to cloud server 1210 is lost; statemanagement during short-term connection failure and long-term connectionfailure; state management when all updates need to be rolled-back; andstate management when there are dependent payloads (e.g., this is thesituation when a system or component has both critical system relatedcontrol updates and user updates. Critical updates may be transmittedthrough the secure client and user updates may be transmitted throughnon-critical client).

Synchronization may be performed in a variety of devices in the system.In one implementation, the synchronization may be performed at theserver level, such as by cloud server 1210. For example, all the eSyncClient devices may directly connect with cloud server 1210, with theeSync Client devices being mutually exclusive and with no internaldependencies on each other. Cloud server 1210 may manage all versioninformation and update status.

In an alternate implementation, the synchronization is performed by oneof the eSync Client devices in the vehicle. For example, one of theeSync Client devices in the vehicle may be designated as the masterclient device, and may be responsible for determining how to synchronizethe remaining eSync Client devices in the vehicle.

To implement the synchronization by a device in the vehicle, variouscriteria may be defined including:

eSync Client Organization: Each eSync Client device may have a DMTreewith a DeviceID to identify the eSync Client device uniquely to thecloud server 1210. Each of the DeviceID may be appended to the vehicleVIN (or other unique identifier of the vehicle) as all the eSync Clientdevices belong to a single vehicle and are identified with the singlevehicle.

eSync Client Master: Among the multiple eSync Client devices in asystem, one eSync Client device is designated as the master to securelyupdate the vehicle. In one implementation, any eSync Client device maybe a master; however, there is only one master eSync Client device inthe system.

Payload Session Token: Every cloud connection established between cloudserver 1210 and a respective eSync Client device that results in atransfer of payload, may include a new Payload Session Token. ThePayload Session Token indicates that a new payload has been transferred.The Payload Session Token will remain in force until the transfer of thenew payload. New payload may be defined as any software update thatreplaces the update currently in the eSync Client device for updatingECUs. It may be an older version or a newer version of the softwarecurrently running in the ECUs.

Virtual Link: When the cloud server 1210 disconnects from the vehicle,all the eSync Client devices may make a connection to the master eSyncClient device through a secure link called the virtual link. The linkmay behave exactly as if the follower eSync Client devices have aconnection to the cloud server 1210. This virtual link allows thefollower eSync Client devices to verify their respective session keyagainst the one that is in the master eSync Client device. Each followerclient session key may have a decay tag (e.g., a programmable time limitin which the key is still valid) that counts down to zero. Upon reachingzero, the follower eSync Client devices may make a secure connection tothe master eSync Client device. The master eSync Client device may alsohave a timer that indicates when the system should contact the cloudserver.

Update Flag: Each payload transfer from the server may cause the UpdateFlag to be reset. In one implementation, an eSync Client device may onlyset the flag but cannot reset it. In this implementation, only themaster eSync Client device has the permissions to reset the flag ifneeded.

Connection State Flag: This flag lets a follower eSync Client deviceknow that a connection to the cloud server 1210 is available.

Master eSync Client Control Channel: The master eSync Client device maycommunicate with the cloud server 1210 to download policies that affectall other follower eSync Client devices and list of interdependent ECUs(which may be updated by two different eSync Client devices, such asillustrated in FIG. 12B) in the manifest being downloaded by otherclients.

Generic eSync Client Data Channel: This is a method of eSync Clientdevices communicating with servers (such as cloud server 1210). Forexample, an eSync Client device may establish a TLS 1.x (currently 1.2)channel with exchange of X509 certificates. After establishment ofauthentication, the eSync Client device may check for specific downloadsavailable to it.

Update Policy: The update policy for an update is the prescription onthe nature of how new updates will be flashed into the various ECUs inthe vehicle. Policy provision may include, but is not be limited to, thefollowing: time of update; dependencies of software updates betweenECUs; updates to different control paths in the same ECU or CAN firstupdates; etc. Using the update policy, the master eSync Client devicemay determine the nature of the rollback that may be executed in case offailure of an update. In one implementation, there is no a prioriknowledge that one eSync Client device shall have for information aboutother eSync Client devices in the system.

Further, given the multi-client architecture, procedures regardingsecurity and payload download may follow certain procedures. With regardto security setup, each token may be encrypted by the public key foreach eSync Client device, and hence may be made secure as communicationsmay only be decoded by their individual private keys. In addition, evenwhen the master eSync Client device broadcasts the token to the followereSync Client devices, the token may be encrypted with the public key ofthe follower eSync Client devices.

With regard to payload download, the precedence order for payloaddownload to the various eSync Client devices may follow a certainsequence. In one implementation, all follower eSync Client devicesconnect and have their respective payloads downloaded before the mastereSync Client device downloads its own respective payload. This may befor establishing precedence order. The master eSync Client device hasthe old session key to monitor the updates in the system. Further, themaster eSync Client device may be tasked with overseeing the downloads,including whether there is a failure in the downloads. In this regard,the master eSync Client device may monitor the order based on itsprecedence of receiving the download last. Thus, in the event that themaster eSync Client device receives its download (and because the mastereSync Client device receives the download last), the master eSync Clientdevice may determine that all of the other follower eSync Client deviceshave already received their respective downloads. Further, thisprecedence order may be relevant since critical updates may be scheduledfor transmission last as a payload. In one implementation, the mastereSync Client device is configured to receive the critical updates;hence, the precedence order may facilitate the monitoring of thedownloads.

For example, in a system with one master eSync Client device and “N”follower eSync Client devices (where “N” is an integer number greaterthan 0), the master eSync Client device may determine that all other “N”follower eSync Client devices have received the software update downloadif the master eSync Client device has received its software updatedownload. Alternatively, the master eSync Client device may poll the “N”follower eSync Client devices to determine whether the “N” followereSync Client devices have received their respective downloads.

In one implementation, responsive to the master eSync Client devicedetermining that the follower eSync Client devices have received theirrespective software update downloads, the master eSync Client device maycommand the follower eSync Client devices to perform the update. In aspecific implementation, a part of the download from cloud server 1210may include a manifest, with the manifest containing informationindicative of a sequence of the updates to perform. Responsive toreceipt of the manifest, the master eSync Client device may command thefollower eSync Client devices to perform in the sequence as indicated inthe manifest.

Prior to implementing the manifest, the eSync Client device may reviewthe manifest for potential errors. In one implementation, the eSyncClient device may compare the manifest received from the server with theone that the eSync Client device created from version reports from thevarious ECUs. If the eSync Client device detects a difference in themanifest from the server and the one created by the eSync Client device,the eSync Client device may report the difference to the server. Sincethe eSync Client device or the TCU may establish the connection to theserver, the input as to the difference in the manifest from the serverand the one created by the eSync Client device may be used by the serverto reform the manifest and/or payload if needed, and thereby send anupdated manifest and/or payload for the eSync Client device toimplement.

For example, the manifest may indicate that critical updates beperformed first. Thus, the master eSync Client device may command thatcritical domains, such as critical domain 1230 or 1280, perform theupdate using the respective update agents 1236 or 1286 first prior toperforming the update for non-critical domains, such as user domain 1250or 1290.

In one implementation of the system, all eSync Client devices (includingthe master eSync Client device and the follower eSync Client devices)connect to the server individually, are able to check for updates,upload their individual status, and match the version number of theirpayload with that of the server and keep it synchronized. Eachconnection that necessitates a download may require a token associatedwith it. In a specific implementation, each respective eSync Clientdevice receives the session token along with an indicator of the time atwhich the respective eSync Client device is to establish a connectionwith cloud server 1210 (e.g., a “fuel meter” along with the SessionToken, with the respective eSync Client device using the “fuel meter” todetermine when to re-establish a connection with the cloud server). Inpractice, the “fuel meter” may indicate the frequency (e.g., once every6 months) at which the respective eSync Client device is to contact thecloud server 1210.

In this way, the respective client device may independently determinewhen to contact the cloud server 1210 and, responsive to the respectiveclient device determining to contact the cloud server 1210, therespective client device may independently contact the cloud server1210. Thus, in one implementation, all eSync Client devices areindependent and request their own connection to the cloud server 1210and request downloads if necessary. This implementation carries overheadas all the eSync Client devices make contact independently with thecloud server and verify their status. In an alternate implementation,the master eSync Client device may check for connection to the cloudserver 1210 through its control channel. Responsive to the master eSyncClient device determining that the connection to the cloud server 1210is available, the master eSync Client device may send a communication tothe follower eSync Client devices indicating that the connection to thecloud server 1210 is available. Responsive to the communication sentfrom the master eSync Client device indicating that the connection tothe cloud server 1210 is available, the follower eSync Client devicesmay initiate communication with the cloud server 1210. Responsive to themaster eSync Client device determining that the connection to the cloudserver 1210 is unavailable, the master eSync Client device may set atimer (e.g., 1 hour in the future, 1 day in the future, 1 week in thefuture, etc.) to re-check whether the connection to the cloud server1210 is available. After successfully retrying the connection, themaster eSync Client device may notify the follower eSync Client devicesindicating that the connection to the cloud server 1210 is available.

Given the various functions performed by the eSync Client devices, theeSync Client devices may be in one of several states. Specifically,depending on the stage of the update process and whether a failure hasoccurred, the system may be in one of several states. In state 0, alleSync Client devices are able to connect to the cloud server 1210 andmanage their respective downloads independently (including those eSyncClient devices that have dependencies, as illustrated in FIG. 12B). EacheSync Client device may report its update status to the cloud server1210, with the cloud server 1210 knowing the status of each respectiveeSync Client device. If there is a failure of the update eSync Clientdevice or a dependent eSync Client device, the cloud server 1210 mayinitiate a roll back to a previous software version.

However, if the connection to the cloud server 1210 is broken withoutverification of the software update but after the downloads of thesoftware updates are complete, the master eSync Client device may invokestate 1, and the virtual link may be established in one or more of thetarget devices (e.g., in the TCU) so that all communications now occurwith the master eSync Client device (e.g., the follower eSync Clientdevices communicate with the master eSync Client device rather than withthe cloud server 1210). In particular, the master eSync Client devicemay perform at least one action to maintain the virtual link between afollower eSync Client device and the cloud server 1210. This isillustrated in U.S. Pat. No. 8,761,101, which is incorporated byreference herein in its entirety.

As discussed above, the eSync Client devices, such as the follower eSyncClient devices, may perform various functions, including: communicatingwith the cloud server 1210 in order to obtain the software updatedownload; after receiving the software update download, commencing thesoftware update process; and verifying that the software update has beencompleted. In one implementation, the eSync Client devices, such as thefollower eSync Client devices, may perform any one, any combination orall of these functions independently, such as without any communicationwith or without approval by the master eSync Client device.Alternatively, the eSync Client devices, such as the follower eSyncClient devices, may perform any one, any combination or all of thesefunctions dependent on communication with or approval from the mastereSync Client device.

For example, in one implementation, the follower eSync Client devicesmay communicate with the cloud server 1210 without the master eSyncClient device instructing the follower eSync Client devices to do so.Alternatively, the follower eSync Client devices may communicate withthe cloud server 1210 only in response to a communication sent from themaster eSync Client device instructing the follower eSync Client devicesto do so.

As another example, the follower eSync Client devices may commence thesoftware update process (after the follower eSync Client devices receivethe software update download) without the master eSync Client deviceinstructing the follower eSync Client devices to do so. Alternatively,the follower eSync Client devices may commence the software updateprocess only in response to a communication sent from the master eSyncClient device instructing the follower eSync Client devices to do so. Asone example, the master eSync Client device may wait until the softwareupdates have been downloaded to all eSync Client devices (including themaster eSync Client device and all follower eSync Client devices) beforeinstructing the follower eSync Client devices to commence the softwareupdate process. As another example, the master eSync Client device mayexamine the content of one, some, or all of the software updatedownloads in order to determine whether to instruct the follower eSyncClient devices to commence the software update process. In particular,the software update download may include the delta update, and newsession keys. In one implementation, the master eSync Client device mayinspect the new session keys in one, some or all of the follower eSyncClient devices, such as the session keys for software updates that aredependent payloads, and may verify that all session keys match. Inresponse to this inspection/verification, the master eSync Client devicemay instruct the follower eSync Client device(s) to commence thesoftware update process. For example, FIG. 12B illustrates that ECU 1288potentially has dependent payloads, such as one payload for the ControlECU and a second payload for surround view (CAM) park assist. The mastereSync Client device (such as eSync Client—1 (1284)) may analyze thesession keys for the downloads for each of the Control ECU and a secondpayload for surround view (CAM) park assist. Responsive to the mastereSync Client device verifying that the session keys match, the mastereSync Client device (such as eSync Client—1 (1284)) may instruct thefollower eSync Client device (such as eSync Client—2 (1295)) to commencewith the software update process for surround view (CAM) park assist.

Conversely, eSync Client devices that operate independently may initiatetheir respective updates without any need to verify control; however, inone implementation, the independent eSync Client devices may still haveto maintain their respective session keys for validation by the mastereSync Client device.

Responsive to a respective eSync Client device commencing the update,the respective eSync Client device may set a flag (e.g., set “updateflag” to “1”) indicating that an update has occurred.

State 2 in the system results if there is a failure in the updateprocess, such as a failure in the update process for any one, some, orall of the follower eSync Client devices. In practice, the master eSyncClient device may communicate with the follower eSync Client devices todetermine whether the failure has occurred. In response to thisdetermination, the master eSync Client device may change the state ofthe system to state 2.

In state 2, the master eSync Client device may determine whether toperform a rollback (e.g., rolling back the software to a previousversion), and if so, which target devices to rollback. In particular,the master eSync Client device may access the update policy, discussedabove, to determine whether/which target devices to rollback. As oneexample, the update policy may indicate that a failure in one or some ofthe update processes in the eSync Client devices results in a globalrollback for all eSync Client devices (e.g., a single failure results inall eSync Client devices revert back to their previous versions andreport the reversion to the cloud server 1210 is connected). As anotherexample, the update policy may indicate that a failure in one or some ofthe update processes results in rollback only in the failed devices(e.g., if the update policy indicates that rollback only occurs infailed clients or dependent clients, then the rollback is performed onlyon those clients that have been marked as having failed). In the exampleillustrated in FIGS. 12B and 13B, if there is a failure in updating thesoftware for the Control ECU, but not a failure in updating the softwarefor surround view (CAM) park assist, the master eSync Client device(e.g., eSync Client—1 (1284)) may instruct the follower eSync Clientdevice (eSync Client—2 (1295)) to perform a rollback on surround view(CAM) park assist and the master eSync Client device (e.g., eSyncClient—1 (1284)) may perform the rollback on Control ECU. Conversely, ifthere is a failure in updating the software for surround view (CAM) parkassist, but not a failure in updating the software for the Control ECU,the master eSync Client device (e.g., eSync Client—1 (1284)) mayinstruct the follower eSync Client device (eSync Client—2 (1295)) toperform a rollback on surround view (CAM) park assist and the mastereSync Client device (e.g., eSync Client—1 (1284)) may perform therollback on Control ECU.

State 3 in the system results when the master eSync Client device hasnot received a new session key (e.g., no payload); however, some of thefollower eSync Client devices have received new payloads. As discussedabove, in one implementation, the master eSync Client device receivesthe payload/download last from the cloud server 1210. In the event thatthe connection with the cloud server 1210 is broken after some of thefollower eSync Client devices have received their respectivepayloads/downloads, but before the master eSync Client device receivesits respective payload/download from the cloud server 1210, the systementers state 3. In this state, the master eSync Client device may reviewthe policy obtained to determine if any of follower eSync Client devicesare dependent clients. An example of a dependent client is illustratedin FIGS. 12B and 13B, with ECU 1288 spanning across the critical domain1280, 1380 and the user domain 1290, 1390. In the event that eSyncClient—2 (1295) has received its respective payload/download, the mastereSync Client device may determine to delay commencing the update processuntil the master eSync Client device (e.g., eSync Client—1 (1284))receives its respective payload/download. In a first specificimplementation, responsive to the master eSync Client device determiningthat all dependent clients have received the respective payload/download(including the master eSync Client device), the master eSync Clientdevice may instruct the follower eSync Client devices to perform theupdate. After which, the master eSync Client device may commence its ownupdate of the target device. Alternatively, responsive to the mastereSync Client device determining that all dependent clients have receivedthe respective payload/download (including the master eSync Clientdevice), the master eSync Client device may commence its own update ofthe target device. After which, the master eSync Client device mayinstruct the follower eSync Client devices to perform the update.

With regard to state 4, this occurs when either a rollback has happenedor all software updates have been flashed and a new server connection isbeing sought by the eSync Client device. For example, in response to theupdate policy indicating that the respective eSync Client deviceindependently communicates with the cloud server 1210 to report theflash of the software update, the respective eSync Client deviceinitiates the communication with the cloud server 1210. As anotherexample, in response to the update policy indicating that the mastereSync Client device communicates with the cloud server 1210 to reportthe flash of the software update for the follower eSync Client devices,the master eSync Client device initiates the communication with thecloud server 1210. As discussed above, a “fuel meter” may be indicativeof the time for the respective eSync Client device to reconnect with thecloud server 1210. In particular, the eSync Client device may wait forthe “fuel meter” to count down before attempting to establishconnection. If no connection to the cloud server 1210 is possible, thenthe transition to another state does not occur. Further, the “fuelmeter” may be refilled with the time and the eSync Client device (suchas the master eSync Client device) may wait again for the “fuel meter”to indicate that a request to the cloud server 1210 is scheduled, or mayhave a faster decrement to re-establish connection. For example, theremay be instances where the eSync Client device (such as the master eSyncClient device and/or follower eSync Client devices) may wish to decreasethe time between connection attempts with the cloud server 1210. Forexample, the “fuel meter” may be decreased from a first predeterminedtime period (e.g., 1 hour) to a second predetermined time period lessthan the first predetermined time period (e.g., ½ hour).

As discussed above, the update policy may indicate the nature of how newupdates will be flashed in the various target devices, such as in thevarious ECUs in the vehicle. Specifically, the update policy may includetiming aspects (such as under what conditions the updates are to occur).An eSync Client device (such as the master eSync Client device) mayreview the update policy in order to determine when to perform theupdate. For example, the update policy may indicate the conditions, suchas the communication condition(s) (e.g., whether the vehicle isconnected to Wi-Fi; whether the vehicle has a cellular communicationsignal better than a certain amount); the car vehicle conditions (e.g.,is the vehicle turned off; is the vehicle turned on, but in the parkedposition). In this way, the eSync Client device may determine when toperform the updates.

In one implementation, the eSync Client device (such as the master eSyncClient device) may have additional logic (such as a local rules engine)in which to determine when to perform the updates. In a first specificimplementation, the eSync Client device may implement the update policyas dictated. In a second specific implementation, the eSync Clientdevice may implement the update at least partly differently (andpotentially contrary to) the update policy. For example, the eSyncClient device may determine a status (such as a current status) internalto the vehicle and/or external to the vehicle. In one particularexample, the vehicle may have one or more diagnostic codes (such asdiagnostic trouble codes (DTC)) that may indicate the current status ofthe vehicle. The eSync Client device may access the one or morediagnostic codes (which may indicate a problem in the vehicle, such as a“Check Engine” designation) and determine not to perform the softwareupdate based on the update policy. In this regard, the eSync Clientdevice may reject (at least temporarily) the update policy. For example,the eSync Client device may reject performing the update until thestatus of the vehicle has changed (e.g., responsive to the eSync Clientdevice determining that the DTC is no longer indicative of a problemwith the vehicle, the eSync Client device performs the update). Inanother particular example, the vehicle may have one or more diagnosticcodes that may indicate a future status of the vehicle (e.g., asuspected problem that may occur in the future). Similarly, the eSyncClient device may determine not to perform the software update based onthe update policy in response to the future status of the vehicle. Instill another particular example, the vehicle may receive an alert (suchas a traffic alert, a weather alert, or the like), with the alertindicative of a current status external to the vehicle. Responsive toreceiving the alert, the eSync Client device may determine not toperform the software update based on the update policy, and in effect,may reject (at least temporarily) the update policy.

In still an alternate implementation, the eSync Client device maydetermine a “car-safe” level. The “car-safe” level is discussed in U.S.Pat. No. 9,374,423 (incorporated by reference herein in its entirety).As merely one example, the state of the vehicle may be reflected in adetermined car safe level. A controller, such as the controller for theeSync Client device, may determine based on one or more inputs, thecar-safe level. In one implementation, there may be a predeterminednumber of car safe levels, such as 0 to 10 (e.g., 0, 1, 2, 3, 4, 5, 6,7, 8, 9, and 10). The eSync Client device may determine to perform theupdate responsive to determining that the car-safe level is equal (orless than) a predetermined level (e.g., less than 5).

As one example, a driver is leaving his home at 3:30 PM. It isdetermined that, based on current traffic conditions, it would take 1hour to drive to his destination (e.g., the airport). Given theseinputs, and no reports of inclement weather (or reports that the weatheris acceptable), the controller may determine that the car safe level is0 (e.g., indicative of very good driving conditions). In response to theeSync Client device determining that the car safe level is 0, the eSyncClient device may perform the update. As another example, the driver maybe traveling at 55 MPH. The weather is partly cloudy, with goodvisibility and good traffic conditions. Given the increase in speed ofthe vehicle, the controller may determine that the car safe level is 6(e.g., indicative of acceptable driving conditions). In response to theeSync Client device determining that the car safe level is 6, the eSyncClient device may determine to temporarily delay performing the update(e.g., until the car safe level is below a 5). As still another example,the driver is driving at 55 MPH. The weather has changed and is raining.Traffic likewise is starting to get moderately busy. Given theseconditions, the controller determines that the car safe level is 8,reflecting a deterioration in conditions. In response to the eSyncClient device determining that the car safe level is 8, the eSync Clientdevice may determine to temporarily delay performing the update. As yetanother example, the driver increases his speed to 60 MPH. The weatheris still inclement and rainy. The traffic is heavy. Given theseconditions, the car safe level may be set to 10 (e.g., indicative ofvery bad conditions). In response to the eSync Client device determiningthat the car safe level is 10, the eSync Client device may determine totemporarily delay performing the update. The eSync Client device maythus use the current car-safe level in order to determine whether toperform the update at the current time.

Alternatively, the eSync Client device may analyze the type of update,and the current status (such as inside the vehicle and/or outside of thevehicle) in order to determine whether to perform the update. As oneexample, machine learning may cause the rules engine to be updated.Specifically, the rules engine may be updated such that, responsive todetermining that the software update is directed to the heating system(such as the seat warmers), and responsive to determining that thetemperature of the vehicle outside is below a certain predeterminedtemperature, the rules engine, which may be part of the eSync Clientdevice, may determine that the update is considered directed to acritical region or is considered a higher priority. In response to thisdetermination, the rules engine may delay the software update (even ifthe update policy indicates that the software update should be updatedimmediately).

In still an alternate implementation, the eSync Client device maysolicit input from an external source prior to determining to performthe update. For example, the eSync Client device may send acommunication to a user of the vehicle, such as an app on a smartphoneassociated with the user of the vehicle, requesting permission toperform the software update. Responsive to receiving an indication ofapproval to perform the update from the user of the vehicle, the eSyncClient device may perform the software update. Responsive to receivingan indication not to perform the update from the user of the vehicle,the eSync Client device may delay performing the software update. Forexample, responsive to receiving an indication not to perform the updatefrom the user of the vehicle, the eSync Client device may set a timer(such as for 1 day, 1 week, etc.) in which to request approval again.Alternatively, the user of the vehicle, in the communication indicativenot to perform the software update, may indicate a time in the future(such as in 1 day, 1 week, etc.) in which to perform the softwareupdate. In response to receiving from the user the time in the future inwhich to perform the software update, the eSync Client device mayschedule the software update for the time in the future. In yet anotherexample, the eSync Client device may allow the user to delay thesoftware update for a certain period of time (such as 2 weeks); afterwhich, the eSync Client device will perform the software updateregardless of whether the user has given approval to perform thesoftware update.

FIG. 14 illustrates a general computer system 1400, programmable to be aspecific computer system 1400, which can represent any server,electronic device or electronic component disclosed herein, such as anyserver, any vehicle client, any ECU, any gateway, any head unit, or thelike. The computer system 1400 may include an ordered listing of a setof instructions 1402 that may be executed to cause the computer system1400 to perform any one or more of the methods or computer-basedfunctions disclosed herein. The computer system 1400 can operate as astand-alone device or can be connected, e.g., using the network 1445, toother computer systems or peripheral devices.

In a networked deployment, the computer system 1400 can operate in thecapacity of a server or as a client-user computer in a server-clientuser network environment, or as a peer computer system in a peer-to-peer(or distributed) network environment. The computer system 1400 can alsobe implemented as or incorporated into various devices, such as apersonal computer or a mobile computing device capable of executing aset of instructions 1402 that specify actions to be taken by thatmachine, including and not limited to, accessing the Internet or Webthrough any form of browser. Further, each of the systems described caninclude any collection of sub-systems that individually or jointlyexecute a set, or multiple sets, of instructions to perform one or morecomputer functions.

The computer system 1400 can include a memory 1404 on a bus 1420 forcommunicating information. Code operable to cause the computer system toperform any of the acts or operations described herein can be stored inthe memory 1404. The memory 1404 can be a random-access memory,read-only memory, programmable memory, hard disk drive or any other typeof volatile or non-volatile memory or storage device.

The computer system 1400 can include a processor 1408, such as a centralprocessing unit (CPU) and/or a graphics-processing unit (GPU). Theprocessor 1408 can include one or more general processors, digitalsignal processors, application specific integrated circuits, fieldprogrammable gate arrays, digital circuits, optical circuits, analogcircuits, combinations thereof, or other now known or later-developeddevices for analyzing and processing data. The processor 1408 canimplement the set of instructions 1402 or other software program, suchas manually programmed or computer-generated code for implementinglogical functions. The logical function or any system element describedcan, among other functions, process and convert an analog data sourcesuch as an analog electrical, audio, or video signal, or a combinationthereof, to a digital data source for audio-visual purposes or otherdigital processing purposes such as for compatibility for computerprocessing.

The computer system 1400 can also include a disk or optical drive unit1415. The disk drive unit 1415 can include a computer-readable medium1440 in which one or more sets of instructions 1402, e.g., software, canbe embedded. Further, the instructions 1402 can perform one or more ofthe operations as described herein. The instructions 1402 can residecompletely, or at least partially, within the memory 1404 or within theprocessor 1408 during execution by the computer system 1400.Accordingly, various databases, such as software repository revisions,delta 162, sync repository revisions, delta 172, local secure storage412, flash memory 416, software repository revisions, delta 766, syncrepository revisions, delta 774, server DB 912, etc., can be stored inthe memory 1404 or the disk unit 1415.

The memory 1404 and the processor 1408 also can includecomputer-readable media as discussed above. A “computer-readablemedium,” “computer-readable storage medium,” “machine readable medium,”“propagated-signal medium,” or “signal-bearing medium” can include anydevice that has, stores, communicates, propagates, or transportssoftware for use by or in connection with an instruction executablesystem, apparatus, or device. The machine-readable medium canselectively be, but not limited to, an electronic, magnetic, optical,electromagnetic, infrared, or semiconductor system, apparatus, device,or propagation medium.

Additionally, the computer system 1400 can include an input device 1425,such as a keyboard or mouse, configured for a user to interact with anyof the components of system 1400. It can further include a display 1470,such as a liquid crystal display (LCD), a cathode ray tube (CRT), or anyother display suitable for conveying information. The display 1470 canact as an interface for the user to see the functioning of the processor1408, or specifically as an interface with the software stored in thememory 1404 or the drive unit 1415.

The computer system 1400 can include a communication interface 1436 thatenables communications via the communications network 1445. The network1445 can include wired networks, wireless networks, or combinationsthereof. The communication interface 1436 network can enablecommunications via any number of communication standards, such as802.11, 802.17, 802.20, WiMax, 802.15.4, cellular telephone standards,or other communication standards, as discussed above. Simply because oneof these standards is listed does not mean any one is preferred, as anynumber of these standards can never actually be adopted in a commercialproduct.

Block diagrams of different aspects of the system, including thoseillustrated herein including FIGS. 1-13B, may be implemented using thecomputer functionality disclosed in FIG. 14. Further, the flow diagramsillustrated herein, including FIGS. 10A-11, may use computer readableinstructions that are executed by one or more processors in order toimplement the functionality disclosed.

The present disclosure contemplates a computer-readable medium thatincludes instructions or receives and executes instructions responsiveto a propagated signal, so that a device connected to a network cancommunicate voice, video, audio, images or any other data over thenetwork. Further, the instructions can be transmitted or received overthe network via a communication interface. The communication interfacecan be a part of the processor or can be a separate component. Thecommunication interface can be created in software or can be a physicalconnection in hardware. The communication interface can be configured toconnect with a network, external media, the display, or any othercomponents in system, or combinations thereof. The connection with thenetwork can be a physical connection, such as a wired Ethernetconnection or can be established wirelessly as discussed below. In thecase of a service provider server, the service provider server cancommunicate with users through the communication interface.

The computer-readable medium can be a single medium, or thecomputer-readable medium can be a single medium or multiple media, suchas a centralized or distributed database, or associated caches andservers that store one or more sets of instructions. The term“computer-readable medium” can also include any medium that can becapable of storing, encoding or carrying a set of instructions forexecution by a processor or that can cause a computer system to performany one or more of the methods or operations disclosed herein.

The computer-readable medium can include a solid-state memory such as amemory card or other package that houses one or more non-volatileread-only memories. The computer-readable medium also can be a randomaccess memory or other volatile re-writable memory. Additionally, thecomputer-readable medium can include a magneto-optical or opticalmedium, such as a disk or tapes or other storage device to capturecarrier wave signals such as a signal communicated over a transmissionmedium. A digital file attachment to an email or other self-containedinformation archive or set of archives can be considered a distributionmedium that can be a tangible storage medium. The computer-readablemedium is preferably a tangible storage medium. Accordingly, thedisclosure can be considered to include any one or more of acomputer-readable medium or a distribution medium and other equivalentsand successor media, in which data or instructions can be stored.

Alternatively or in addition, dedicated hardware implementations, suchas application specific integrated circuits, programmable logic arraysand other hardware devices, can be constructed to implement one or moreof the methods described herein. Applications that can include theapparatus and systems of various embodiments can broadly include avariety of electronic and computer systems. One or more embodimentsdescribed herein can implement functions using two or more specificinterconnected hardware modules or devices with related control and datasignals that can be communicated between and through the modules, or asportions of an application-specific integrated circuit. Accordingly, thepresent system can encompass software, firmware, and hardwareimplementations.

The methods described herein may be implemented by software programsexecutable by a computer system. Further, implementations may includedistributed processing, component/object distributed processing, andparallel processing. Alternatively or in addition, virtual computersystem processing may be constructed to implement one or more of themethods or functionality as described herein.

Thus, as discussed above, a respective electronic device registered withthe broker may have associated with it the respective certificateindicative of the respective electronic device being entitled to receivemessages of the alert message type. In that instance, the processor maybe configured to: receive, from the respective electronic device, acertificate change message, the certificate change message indicative tothe broker device to generate an updated certificate associated with therespective electronic device indicative of a change such that therespective electronic device is no longer entitled to receive messagesof the alert message type; and responsive to receiving the certificatechange message, cause the updated certificate to be generated. Further,the certificate change message may be generated based on the respectiveelectronic device's analysis of its respective computational or memorycapabilities and based on an amount of processing of the messages of thealert message type.

In another implementation, the processor is configured to generate atree structure of the electronic devices registered. The processor mayfurther be configure to: receive, from the sender electronic device, atree structure message, the tree structure message comprising a payloadand an indicator of one or more nodes in the tree structure; responsiveto receiving the tree structure message, determine, based on the treestructure and the indicator of one or more nodes in the tree structure,a set of addresses in the tree structure to route the message to; andsend at least a part of the tree structure message to the set ofaddresses.

In another implementation, a broker device is disclosed that isconfigured to communicate with a plurality of electronic devices in avehicle. The broker device comprises: at least one memory; and at leastone processor. The processor is configured to: communicate with theplurality of electronic devices in order to obtain address indicationsand to validate whether the electronic devices are entitled tocommunicate with the broker device, wherein in order to validate arespective electronic device, the broker device receives from therespective electronic device a respective certificate in order todetermine whether the respective certificate is indicative of allowingthe respective electronic device to communicate via the broker devicewith other electronic devices in the vehicle; responsive to validatingthe respective electronic device, access the respective certificate inorder to determine one or more types of messages that the respectiveelectronic device is entitled to receive or send; update one or moretables correlating a non-address indication of the respective electronicdevice with the one or more message types that the respective device isassociated with and correlating the non-address indication of therespective electronic device with an address indication of therespective electronic device in order to register the electronic deviceswith the broker device, the address indication used by the broker deviceto route messages to the respective electronic device; receive, from asender electronic device selected from the registered electronicdevices, a message from one of the plurality of electronic devices, themessage including a specific message type and a payload, the message notincluding any address indications for use by the broker device to routethe message; responsive to receipt of the message or responsive toseparate polling message, the message including the specific messagetype: access the one or more tables correlating the message types torespective non-address indications of the plurality of electronicdevices registered with the broker device in order to determine a subsetof the electronic devices correlated to the specific message type; send,to the sender electronic device, the non-address indications for each ofthe electronic devices in the subset; receive, from the senderelectronic device, one or more subsequent messages, the one or moresubsequent messages including the non-address indications for each ofthe electronic devices in the subset; access the one or more tablescorrelating non-address indications with address indications in order toaccess the address indications correlated to each of the electronicdevices in the subset; and route the one or more subsequent messages tothe address indications correlated to each of the electronic devices inthe subset.

As discussed above, multiple domains may be defined in the vehicleincluding a first domain and a second domain that have different networklayouts. Alternatively, or in addition, the first domain may comprise aplurality of different networks. Further, the different domains may haverespective software update modules, such as a software update modulebeing instantiated in a head unit of the vehicle, and wherein the headunit further includes an update agent in order to update the software inthe head unit of the vehicle. Another software update module may beinstantiated in a gateway of the vehicle, wherein the gateway is notsubject to update of its software via the software update moduleinstantiated therein. The critical domain may include a control ECU sothat the software update module (instantiated in the gateway) isconfigured to communicate with the external server in order to obtainthe software update for the control ECU and to transmit the softwareupdate to an update agent resident in the control ECU, and wherein theupdate agent resident in the control ECU is configured to decrypt anddecompress the software update in order to install the software updateinto the control ECU.

Further, as discussed above, brokers may be resident in the differentdomains, such as a first broker device resident in the first domain anda second broker device resident in the second domain. The first brokermay be configured to: communicate with the first software update moduleand the electronic devices in the first domain in order to validatewhether the first software update module and the electronic devices areentitled to communicate with the first broker device; responsive tovalidating the first software update module and the electronic devices,update one or more tables correlating a non-address indication of thefirst software update module and the electronic devices and an addressindication of the first software update module and the electronicdevices in order to register the first software update module and theelectronic devices with the first broker device, the address indicationused by the first broker device to route messages from the firstsoftware update module to the electronic devices; receive a softwareupdate message from the first software update module, the softwareupdate message including the non-address indication of the an electronicdevice in the first domain; and route, using the non-address indicationof the electronic device in the first domain and the one or more tables,the software update message to the electronic device in the first domainin order for the electronic device in the first domain to update itssoftware; and

The second broker may be configured to: communicate with the secondsoftware update module and the electronic devices in the second domainin order to validate whether the second software update module and theelectronic devices are entitled to communicate with the second brokerdevice; responsive to validating the second software update module andthe electronic devices, update one or more tables correlating anon-address indication of the second software update module and theelectronic devices and an address indication of the second softwareupdate module and the electronic devices in order to register the secondsoftware update module and the electronic devices with the second brokerdevice, the address indication used by the second broker device to routemessages from the second software update module to the electronicdevices; receive a software update message from the second softwareupdate module, the software update message including the non-addressindication of the an electronic device in the second domain; and route,using the non-address indication of the electronic device in the seconddomain and the one or more tables, the software update message to theelectronic device in the second domain in order for the electronicdevice in the second domain to update its software.

Finally, the first broker in the first domain may further be configuredto: receive a session key message from the first software update module,the session key message including an encrypted session key andindicative of a non-address indication of an electronic device in thefirst domain; and route, using the non-address indication of theelectronic device in the first domain and the one or more tables, thesession key message to the electronic device in the first domain; andwherein the software update message is encrypted using the session key;and wherein the first broker is configured to route the software updatemessage to the electronic device in the first domain without decryptingthe software update message encrypted with the session key.

Although components and functions are described that may be implementedin particular embodiments with reference to particular standards andprotocols, the components and functions are not limited to suchstandards and protocols. For example, standards for Internet and otherpacket switched network transmission (e.g., TCP/IP, UDP/IP, HTML, andHTTP) represent examples of the state of the art. Such standards areperiodically superseded by faster or more efficient equivalents havingessentially the same functions. Accordingly, replacement standards andprotocols having the same or similar functions as those disclosed hereinare considered equivalents thereof.

The illustrations described herein are intended to provide a generalunderstanding of the structure of various embodiments. The illustrationsare not intended to serve as a complete description of all of theelements and features of apparatus, processors, and systems that utilizethe structures or methods described herein. Many other embodiments canbe apparent to those of skill in the art upon reviewing the disclosure.Other embodiments can be utilized and derived from the disclosure, suchthat structural and logical substitutions and changes can be madewithout departing from the scope of the disclosure. Additionally, theillustrations are merely representational and cannot be drawn to scale.Certain proportions within the illustrations may be exaggerated, whileother proportions may be minimized. Accordingly, the disclosure and thefigures are to be regarded as illustrative rather than restrictive.

The Abstract of the Disclosure is provided to comply with 37 C.F.R. §1.72(b) and is submitted with the understanding that it will not be usedto interpret or limit the scope or meaning of the claims. In addition,in the foregoing Detailed Description, various features may be groupedtogether or described in a single embodiment for the purpose ofstreamlining the disclosure. This disclosure is not to be interpreted asreflecting an intention that the claimed embodiments require morefeatures than are expressly recited in each claim. Rather, as thefollowing claims reflect, inventive subject matter may be directed toless than all of the features of any of the disclosed embodiments. Thus,the following claims are incorporated into the Detailed Description,with each claim standing on its own as defining separately claimedsubject matter. In this regard, the above disclosed subject matter is tobe considered illustrative, and not restrictive, and the appended claimsare intended to cover all such modifications, enhancements, and otherembodiments, which fall within the true spirit and scope of thedescription. Thus, to the maximum extent allowed by law, the scope is tobe determined by the broadest permissible interpretation of thefollowing claims and their equivalents, and shall not be restricted orlimited by the foregoing detailed description.

We claim:
 1. A broker device configured to communicate with a pluralityof electronic devices in a vehicle, the broker device comprising: atleast one memory; and at least one processor configured to: cause one ormore certificate to be generated using certificate managementfunctionality; communicate with the plurality of electronic devices inorder to validate whether the electronic devices are entitled tocommunicate with the broker device, wherein in order to validate arespective electronic device, the broker device accesses a respectivecertificate generated by the broker device using the certificatemanagement functionality in order to determine whether the respectivecertificate is indicative of allowing the respective electronic deviceto communicate via the broker device with other electronic devices inthe vehicle; responsive to validating the respective electronic device,update one or more tables correlating a non-address indication of therespective electronic device and an address indication of the respectiveelectronic device in order to register the respective electronic devicewith the broker device, the address indication used by the broker deviceto route messages to the respective electronic device; receive a sessionkey message from a first electronic device, the session key messageincluding an encrypted session key and indicative of a non-addressindication of a second electronic device; route, using the non-addressindication of the second electronic device and the one or more tables,the session key message to the second electronic device; receive asession message from one of the first electronic device or the secondelectronic device, the session message including a message encryptedwith the session key, and the non-address indication of the other of thefirst electronic device or the second electronic device; and route,using the non-address indication of the other of the first electronicdevice or the second electronic device and the one or more tables, thesession message to the other of the first electronic device or thesecond electronic device without being able to decrypt the sessionmessage encrypted with the session key.
 2. The broker device of claim 1,wherein the broker device is configured to route the session key messagewithout being able to decrypt the session key message.
 3. The brokerdevice of claim 2, wherein the session message is encrypted with apublic key of the other of the first electronic device or the secondelectronic device; and wherein the processor is further configured to:receive a request from the one of the first electronic device or thesecond electronic device for the public key of the other of the firstelectronic device or the second electronic device; and responsive to therequest, send, to the one of the first electronic device or the secondelectronic device, the public key of the other of the first electronicdevice or the second electronic device.
 4. The broker device of claim 2,wherein the broker device comprises a first software thread in a gatewayserver in the vehicle; and wherein the one of the first electronicdevice or the second electronic device comprises an update agent deviceas a second software thread in the gateway server.
 5. The broker deviceof claim 4, wherein the other of the first electronic device or thesecond electronic device comprises an electronic control unit (ECU).wherein prior to receiving the session message, the broker deviceregisters the update agent device and the ECU; and wherein the sessionmessage comprises a software update message for updating software in theECU.
 6. The broker device of claim 4, wherein the broker device is at apredetermined address within the vehicle; and wherein the processor isconfigured communicate with the plurality of electronic devices in orderto validate whether the electronic devices are entitled to communicatewith the broker device by receiving a registration request messageinitiated by the respective electronic device.
 7. The broker device ofclaim 4, wherein the broker device is configured to register therespective electronic device by updating the one or more tables toindicate one or more types of messages that the respective electronicdevice is entitled to send or to receive.
 8. The broker device of claim7, wherein the one of the first electronic device or the secondelectronic device comprises a sender device; wherein the other of thefirst electronic device or the second electronic device comprises arecipient device; wherein the session message is indicative of aspecific type of message; wherein the processor is further configuredto: determine, based on the one or more tables, whether the senderdevice is entitled to send the specific type of message or whether therecipient device is entitled to receive the specific type of message;and responsive to determining that the sender device is not entitled tosend the specific type of message or the recipient device is notentitled to receive the specific type of message, deny routing of thesession message to the recipient device.
 9. The broker device of claim8, wherein the processor is configured to validate the respectiveelectronic device using the respective certificate generated by thebroker device and thereafter received by the broker device from therespective electronic device for validation; and wherein the processoris configured to: determine, based on the one or more tables, whetherthe sender device is entitled to send the specific type of message andwhether the recipient device is entitled to receive the specific type ofmessage; and responsive to determining that either the sender device isnot entitled to send the specific type of message or the recipientdevice is not entitled to receive the specific type of message, denyrouting of the session message to the recipient device.
 10. The brokerdevice of claim 7, wherein the processor is further configured to:receive, from the respective electronic device, a certificate changemessage, the certificate change message indicative to the broker deviceto generate an updated certificate associated with the respectiveelectronic device indicative of a change in one or more types ofmessages the respective electronic device is to receive; and responsiveto receiving the certificate change message, cause the updatedcertificate to be generated.
 11. The broker device of claim 10, whereinthe certificate change message is generated based on the respectiveelectronic device's analysis of its respective computational or memorycapabilities; and wherein the certificate change message is indicativeto the broker device to generate the updated certificate with fewertypes of messages that the respective electronic device is to receivethan the respective certificate previously assigned to the respectiveelectronic device.
 12. The broker device of claim 1, wherein the sessionkey is only valid between starting of the vehicle and turning off of thevehicle.
 13. A broker device configured to communicate with a pluralityof electronic devices in a vehicle, the broker device comprising: atleast one memory; and at least one processor configured to: communicatewith the plurality of electronic devices in order to obtain addressindications and to validate whether the electronic devices are entitledto communicate with the broker device, wherein in order to validate arespective electronic device, the broker device receives from therespective electronic device a respective certificate in order todetermine whether the respective certificate is indicative of allowingthe respective electronic device to communicate via the broker devicewith other electronic devices in the vehicle; responsive to validatingthe respective electronic device, access the respective certificate inorder to determine one or more types of messages that the respectiveelectronic device is entitled to receive or send; update one or moretables correlating message types with address indications whereby anaddress indication of the respective electronic device is correlatedwith the one or more types of messages that the respective electronicdevice is entitled to receive or send in order to register theelectronic devices with the broker device, the address indication usedby the broker device to route messages to the respective electronicdevice; receive, from a sender electronic device selected from theregistered electronic devices, a message from one of the plurality ofregistered electronic devices, the message including a specific messagetype and a payload, the message not including any address indicationsfor use by the broker device to route the message; access the one ormore tables correlating the message types to respective addressindications of the plurality of electronic devices registered with thebroker device in order to determine a subset of the electronic devicescorrelated to the specific message type; generate one or more messageswith the payload and the address indications of each of the electronicdevices in the subset of the electronic devices; and transmit thegenerated one or more messages to each of the electronic devices in thesubset of electronic devices.
 14. The broker device of claim 13, whereinthe types of messages are indicative of one or more groups to which therespective electronic device is associated.
 15. The broker device ofclaim 14, wherein one of the types of messages comprises a group messagetype; and wherein the processor is configured to access the one or moretables that correlates types of messages with address indications inorder to determine the address indications correlated to the groupmessage type indicative that the address indications are allowed toreceive messages for said group.
 16. A vehicle device electronic systemcomprising: a plurality of electronic devices within a vehicle, theplurality of electronic devices comprises a first electronic device anda second electronic device, the first electronic device comprisingsoftware configured to perform a first function, a second electronicdevice comprising software configured to perform the first function anda second function, the first function being different from the secondfunction; a first software update module resident in the vehicle andconfigured to control software updates for electronic devices performingthe first function, thereby defining a first domain of the vehicleindicative of the electronic devices performing the first function; asecond software update module resident in the vehicle and configured tocontrol software updates for electronic devices performing the secondfunction, thereby defining a second domain of the vehicle indicative ofthe electronic devices performing the second function; wherein the firstsoftware update module is configured to update only the electronicdevices performing the first function in the first domain; wherein thesecond software update module is configured to update only theelectronic devices performing the second function in the second domain;wherein the first software update module and the second software updatemodule are configured to perform the following: communicate with anexternal server in order to receive a download of the software updatefor at least one electronic device in a respective domain; and controloperation in order to install the download of the software into the atleast one device in the respective domain; wherein the first softwareupdate module is configured to update the software in the secondelectronic device configured to perform the first function; and whereinthe second software update module is configured to update the softwarein the second electronic device configured to perform the secondfunction.
 17. The vehicle device electronic system of claim 16, whereinthe first software update module comprises a master software updatemodule; wherein the second software update module comprises a followersoftware update module; and wherein the master software update module isconfigured to control the follower software update module in at leastone of the following: time when to communicate with the external serverin order to receive the download of the software update; time when tobegin installation of the software update in the second electronicdevice; and whether to rollback the software in the second electronicdevice responsive to a determination of failure of installation of thesoftware update.
 18. The vehicle device electronic system of claim 17,wherein the first domain is indicative of the electronic devicesassociated with critical functions of the vehicle; wherein the seconddomain is indicative of the electronic devices associated withnon-critical functions of the vehicle; wherein the software configuredto perform the first function comprises critical function software;wherein the software configured to perform the second function comprisesnon-critical function software; wherein the first software update moduleis configured to update the critical function software resident in thesecond electronic device; and wherein the second software update moduleis configured to update the non-critical function software resident inthe second electronic device.
 19. The vehicle device electronic systemof claim 18, further comprising a first broker device resident in thefirst domain and a second broker device resident in the second domain;wherein the first broker is configured to: communicate with the firstsoftware update module and the electronic devices in the first domain inorder to validate whether the first software update module and theelectronic devices are entitled to communicate with the first brokerdevice; responsive to validating the first software update module andthe electronic devices, update one or more tables correlating anon-address indication of the first software update module and theelectronic devices and an address indication of the first softwareupdate module and the electronic devices in order to register the firstsoftware update module and the electronic devices with the first brokerdevice, the address indication used by the first broker device to routemessages from the first software update module to the electronicdevices; receive a software update message from the first softwareupdate module, the software update message including the non-addressindication of the an electronic device in the first domain; and route,using the non-address indication of the electronic device in the firstdomain and the one or more tables, the software update message to theelectronic device in the first domain in order for the electronic devicein the first domain to update its software; and wherein the secondbroker is configured to: communicate with the second software updatemodule and the electronic devices in the second domain in order tovalidate whether the second software update module and the electronicdevices are entitled to communicate with the second broker device;responsive to validating the second software update module and theelectronic devices, update one or more tables correlating a non-addressindication of the second software update module and the electronicdevices and an address indication of the second software update moduleand the electronic devices in order to register the second softwareupdate module and the electronic devices with the second broker device,the address indication used by the second broker device to routemessages from the second software update module to the electronicdevices; receive a software update message from the second softwareupdate module, the software update message including the non-addressindication of the an electronic device in the second domain; and route,using the non-address indication of the electronic device in the seconddomain and the one or more tables, the software update message to theelectronic device in the second domain in order for the electronicdevice in the second domain to update its software.
 20. A vehicle deviceelectronic system comprising: a plurality of electronic devices within avehicle, the plurality of electronic devices comprises a firstelectronic device and a second electronic device, the first electronicdevice performing a first function, a second electronic deviceperforming a second function, the first function being different fromthe second function; a first software update module resident in thevehicle and configured to control software updates for electronicdevices performing the first function, thereby defining a first domainof the vehicle indicative of the electronic devices performing the firstfunction; a second software update module resident in the vehicle andconfigured to control software updates for electronic devices performingthe second function, thereby defining a second domain of the vehicleindicative of the electronic devices performing the second function;wherein the first software update module is configured to update onlythe electronic devices in the first domain; wherein the second softwareupdate module is configured to update only the electronic devices in thesecond domain; wherein the first software update module and the secondsoftware update module are configured to perform the followingindependently of one another: communicate with an external server inorder to receive a download of the software update for at least oneelectronic device in a respective domain; and control operation in orderto install the download of the software into the at least one device inthe respective domain.
 21. The vehicle device electronic system of claim20, wherein the first domain comprises a critical domain and isindicative of the electronic devices associated with critical functionsof the vehicle; and wherein the second domain comprises a non-criticaldomain and is indicative of the electronic devices associated withnon-critical functions of the vehicle.